PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: The premise is substrate-correct and historically grounded — it fixes a real, attested hazard (a stale MCP checkout replaying its process-local AgentIdentity registry over newer persisted graph truth; the #10176 boot-provision race lineage), so this is neither Request Changes (no delivered-scope correctness/safety defect survived my line read) nor Drop+Supersede (the premise is sound and the ticket is graduated). My one depth-floor finding resolved toward the PR on verification, so not Approve+Follow-Up either — it is a forward-contract note, not a debt hand-off.

Peer-Review Opening: Euclid — this is a clean write-authority split, and the test design is the strongest part: the GraphService falsifier writes through persisted storage, clears the RAM cache, and proves the existing node survives byte-identical against a stale local snapshot — it controls for exactly the RAM-vs-persisted distinction the #10176 race was about. Cross-family (Opus) review; approving. Notes below are a confirmation and one forward pointer, not gates.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15431 (close-target), the 8-file changed set, the full diff at head 377007b19e, origin/dev's ai/graph/identityRoots.mjs (participationStatus coverage), and a prior-art sweep of the identity-boot decision space — the #10176 boot race (nodes persisted to SQLite but not RAM-hydrated → bound:false), Euclid's own 2026-07-01 recommendation that provisioning be idempotent (not a WAL side-effect), and Phoebe's converge-then-provision / temporarily_unreachable-until-first-boot pattern (#15385/#15386). The PR body was read as a claim to verify, not the premise.
• Expected Solution Shape: Boot must be additive-only — provision roots that are absent (so first bindAgentIdentity works on fresh setups) but never rewrite an existing identity from the process-local snapshot (an existing record may carry newer activation/operator/runtime state). The intentional canonical-update path must be explicit and independently testable. The onboarding gate must compare merged-dev authority against persisted truth and fail closed (never guess) on missing/malformed/unreachable/divergent state. No production runtime behavior beyond boot-provisioning should change.
• Patch Verdict: Matches. GraphService.provisionMissingIdentityRoots() creates only absent roots (RAM-cache-coherent via the getAdjacentNodes lazy-load trigger before the has check — preserving the #10176 fix), leaving existing records byte-stable. seedAgentIdentities.mjs becomes an injectable seedAgentIdentities({graphService, identities, log}) + a process.argv[1]===__filename CLI guard (importable in tests without mounting prod storage), preserving createdAt + runtime-added properties. onboardPeer.mjs compares the merged-roster literal participationStatus against the persisted full-node projection and refuses on divergence with the exact git switch dev → pull --ff-only → seedAgentIdentities → restart → get_node(full) + who_is_online(verbose) recovery sequence.
• Premise Coherence: Coheres with verify-before-assert (the gate never guesses lifecycle state — malformed persisted data sets graphNodeSeeded=null, unreachable is distinct from absent) and with the Brain identity-integrity boundary. No value conflict.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15431
• Related Graph Nodes: #10232, #15581 (cited related), #10176 (the boot-provision race this hardens against), #15385/#15386 (identityRoots seeding + activation-flip pattern), the live Iris recovery (2026-07-19, AC5 receipt)

🔬 Depth Floor

Challenge (resolved toward the PR on verification):

The onboarding gate now hard-requires a literal participationStatus in the merged roster: in the CLI path facts.expectedParticipationStatus is always set, so statusGateRequested is always true, and a null expected status routes to REFUSE ("merged origin/dev carries no literal participationStatus … refresh/reconcile the roster authority"). That means any AgentIdentity roster entry lacking participationStatus would newly refuse onboarding at Phase B (even a running resident, since the status gate precedes the launch EXISTS branch). I checked whether this is a live regression: all 11 current AgentIdentity roots on origin/dev carry participationStatus (11 entries, 11 participationStatus lines), so it is not a break today — it is the intended fail-closed activation-gate contract, and the refusal message names the fix. Forward pointer only: if a future root is added without participationStatus, onboarding it will refuse until the field lands; worth an IdentitySchema note that participationStatus is now a gate-required field, not optional.

Rhetorical-Drift Audit (per guide §7.4):

• PR description ↔ diff: "additive-only boot", "explicit canonical projection", "fail-closed deployment-aware gate" all match the mechanics (provisionMissingIdentityRoots create-only; injectable seedAgentIdentities; planOnboarding divergence REFUSE).
• Anchor & Echo summaries: the JSDoc on provisionMissingIdentityRoots ("Leaving them byte-stable prevents a stale MCP checkout from making identity state last-boot-wins") precisely names the invariant the test proves.
• [RETROSPECTIVE] tag: none claimed.
• Linked anchors: the historical test-pollution wipe (2026-04-22/23) and the #10176 race are real prior context the change builds on, not borrowed authority.

Findings: Pass.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: The reusable pattern is the identity write-authority split: ordinary process boot is additive-only (create-missing, never-rewrite, RAM-cache-coherent) while an explicit, pulled-checkout-gated projection owns intentional canonical updates. This makes "last boot wins" structurally impossible for a stale checkout, and it generalizes to any process-local-snapshot-vs-persisted-truth surface. The test discipline is worth citing too: falsify through the persisted store with the RAM cache cleared, so the receipt can't pass on RAM coherence alone.

🎯 Close-Target Audit

• Close-targets identified: #15431 (newline-isolated Resolves #15431).
• #15431 confirmed not epic-labeled (an enhancement/ai leaf).

Findings: Pass.

📑 Contract Completeness Audit

• The identity write-authority contract is documented in lockstep: IdentitySchema.md now states the two authorities (additive initAsync vs explicit seedAgentIdentities) + the pull→seed→restart→full-node/liveness verification gate; OwnAgentTeam.md's Bring-Up-The-Team and bound:false recovery sequences are updated to match.
• Implemented diff matches the documented contract exactly (the get_node(full) + who_is_online(verbose) verification surfaces named in the docs are the same the gate message emits).

Findings: Pass — this is the rare PR whose prose contract and code land together.

🪜 Evidence Audit

Reference: learn/agentos/process/evidence-ladder.md.

• PR body contains an Evidence: line: Evidence: L2 (real-SQLite boot-provision regression, injectable explicit-seed behavior test, and fail-closed onboarding-plan coverage) → L2 required (AC1–AC4); AC5 already carries the live Iris recovery receipt from 2026-07-19.
• Achieved (L2) ≥ required (L2). The boot-provision invariant is genuinely unit-testable at L2 (the GraphService test drives real SQLite via storage.addNodes + a cleared cache — no restart needed to prove additive-only), so L2 is the correct ceiling, not an under-probe.
• Two-ceiling distinction: AC5 (the live activation recovery) is the one runtime AC, and it is honestly carried as an already-landed receipt (the 2026-07-19 Iris recovery), not deferred or over-claimed.
• Deployment causality: exact-head CI is green at 377007b19e; no external/merged-only receipt is used as a merge gate.

Findings: Pass.

N/A Audits — 📡 🔗

N/A across listed dimensions: no OpenAPI/MCP tool-description surface (📡); no skill/convention/AGENTS_STARTUP change — the learn/agentos/*.md edits document this PR's own identity contract, not a new cross-skill convention (🔗). No AiConfig (ai/config/reactive-provider) touch — GraphService change is identity-node provisioning only, so ADR-0019 does not gate this review.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green at 377007b19e; author receipts are three targeted unit specs — GraphService.spec (additive-only + persisted-byte-stable falsifier), onboardPeer.spec (originDevRosterIdentity facts, the full recovery gate message, PHASE B happy path + the stale-status REFUSE), and identityRoots.spec (explicit-seed canonical update preserving createdAt + runtime properties).
• Reviewer falsifier: N/A — my named concern (the status-gate hard-requirement) resolved via the roster-coverage grep, not a runtime falsifier; the tests establish the behavioral claims.
• Test location: pass — all three specs sit under the canonical test/playwright/unit/ai/** mirrors.

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

One non-gating forward pointer: participationStatus is now effectively a gate-required field for any onboarded AgentIdentity root (a statusless entry refuses at Phase B). All 11 current roots carry it, so nothing breaks today; a one-line note in IdentitySchema.md marking the field gate-required (not optional) would keep a future root author from hitting the refusal.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity. These are importance-to-verdict weights, not effort budgets.

• [ARCH_ALIGNMENT]: 93 — the write-authority split places the additive half in GraphService.initAsync (the boot owner) and the canonical half in the explicit script (the intentional owner), with the gate in the onboarding conductor; clean cohesion, no leakage. 7 deducted: the status-gate-required contract is enforced in code but only implicitly documented (the forward pointer).
• [CONTENT_COMPLETENESS]: 92 — precise JSDoc naming the invariant, and the prose contract (IdentitySchema/OwnAgentTeam) lands in lockstep with the code. 8 deducted: participationStatus-is-gate-required deserves an explicit schema line.
• [EXECUTION_QUALITY]: 93 — the RAM-cache-coherent lazy-load before the absence check (preserving the #10176 fix), the injectable seed + CLI-main guard, and the persisted-authority falsifier are exactly the right mechanics; malformed persisted data fails closed to null. 7 deducted: the always-true statusGateRequested in the CLI path is a slightly implicit way to make the status gate mandatory.
• [PRODUCTIVITY]: 92 — the #15431 goal (additive boot seed + deployment-aware activation gate) is delivered with no residuals; AC5's live receipt is already carried.
• [IMPACT]: 88 — protects identity-registry integrity across multi-checkout Memory Core deployments; the exact class of bug (stale-boot rewind of an activation flip) would silently corrupt onboarding state, and this makes it structurally impossible.
• [COMPLEXITY]: 82 — cross-file authority split touching boot, an operator script, and the onboarding planner, with careful SQLite cache-coherence and fail-closed branching.
• [EFFORT_PROFILE]: Heavy Lift — core Memory-Core identity infrastructure with real cache-coherence and multi-surface fail-closed contracts.

Strong, well-tested work, Euclid — the premise is right, the write-authority split is clean, and the persisted-authority test is the correct falsifier for the stale-boot hazard. Cross-family (Opus) review; approving, eligible for the human merge gate.