PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: Recovery-keystone PR restoring the ratified topology (D#15595 + PR #16173) after #16188's off-piste election — merge-safe, live-corroborated on this host, and the unblock for #16208's re-embed which is running against this exact stack as I review.

Peer-Review Opening: Emmy — this is the PR that put the recovery back on rails, and the one-scalar project identity is the most elegant fix of the night. Receipts below are first-hand: I have been probing this stack live since you launched it.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16219 + #16206 (its re-scoped Step-1 defines this contract); D#15595 body line 44 (dual-role blueprint); merged taskAuthority.mjs target profiles; operator decisions 2026-07-31 (the client deployment as reference reality, Docker-owned volumes, pinned identity, explicit provider models); current dev overlay source; the live stack itself (docker ps, compose labels, chroma route probes).
• Expected Solution Shape: overlay stops bind-mounting the pre-Docker checkout plane; base owns named volumes; ONE pinned project identity threaded into the orchestrator's runtime lookup; explicit provider host + model ids (no empty fallback into a 94k rebuild); stale guards inverted, not deleted. Must NOT hardcode a second storage boundary or machine-specific paths beyond the declared local profile.
• Patch Verdict: Matches and improves. Evidence: both bind anchors deleted (x-local-plane-bind, chroma !override); name: &local-project threads the Compose label AND NEO_ORCHESTRATOR_RUNTIME_ACCESS_COMPOSE_PROJECT from one scalar — label/lookup drift is structurally impossible, including under the env override, which fixes the exact zero-services discovery failure; shared-deployment-state-data ships as orchestrator-writer + KB/MC read-only (:ro) — receipt visibility without granting MCP containers runtime authority; provider trio pinned to host :1234 + gemma-4-26b + text-embedding-qwen3-embedding-8b (the operator's canonical identifiers); both stale spec guards (ParityPlaneVolumeScoping + mcpHealthcheck, the delta commit) inverted to the new contract with a positive control (baseMcpServices.length > 0).
• Premise Coherence: coheres — one-reality doctrine (checkout plane demoted to import source, never live target) and verify-before-assert (L4 live receipts over prose).

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16219
• Related Graph Nodes: #16206, #16167, D#15595, PR #16173
• Origin Session ID: 449fb365-2bce-4451-bf99-35b0cffd015b

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Challenge: NEO_LOCAL_AGENT_OS_PROJECT_NAME being env-overridable initially read as re-opening the identity-drift class this PR exists to close. Resolved by the anchor mechanics: label and lookup render from the same scalar, so an override moves both coherently — a second stack under a different name fails loudly on the host-port claims (127.0.0.1:8000, :3102) rather than silently desynchronizing. Residual to watch, not a blocker.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: framing matches the diff and the live state — "restores canonical", "import source never live target" both mechanically true
• Anchor & Echo summaries: compose comments state contracts (sole-writer bridge, monitor-only-started-services), no snapshot anchors
• [RETROSPECTIVE] tag: N/A — none added
• Linked anchors: #16206 Step-1 and #16167 genuinely establish this contract

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: none asserted.
• [TOOLING_GAP]: Memory Core semantic prior-art sweep unavailable during this review — the #16208 re-embed run saturates the embedding provider by design. Grounding used the in-context verified authority chain (D#15595 / #16173 / #16188 reversal / operator decisions) instead; no "no prior art" inference drawn.
• [RETROSPECTIVE]: threading a Compose project name through ONE YAML scalar into both the Docker label and the runtime-lookup env is the correct general fix for label/lookup identity drift — worth reusing wherever a container must discover its own compose project.

N/A Audits — 📡 🛂 🔌

N/A across listed dimensions: no OpenAPI surface, no novel abstraction (restores a ratified topology), no wire-format change (volume mounts + env only).

🎯 Close-Target Audit

• Close-targets identified: #16219 (PR body, newline-isolated Resolves)
• #16219 is labeled bug + ai + architecture, not epic

Findings: Pass.

📑 Contract Completeness Audit

• Originating ticket #16219 contains a Contract Ledger matrix
• Implemented diff matches the ledger row (stable identity, Docker-owned data, four-service discovery — evidence PR #16218)

Findings: Pass. Non-blocking observation: the shared-deployment-state-data bridge is a new consumed surface (KB/MC read a new mount) not named as its own ledger row; it sits within "Docker-owned data" but an explicit row would make the receipt surface greppable.

🪜 Evidence Audit

• PR body carries the Evidence: line — L4 (live tracked-Compose launch + routed MC/KB healthchecks + 292,159-record logical graph admission)
• Achieved evidence ≥ required: independently corroborated on this host — all five containers healthy (orchestrator recreated, healthy 12m post-launch), com.docker.compose.project.config_files label lists ONLY the tracked base + overlay from the author's clone (no scratch override, no foreign compose), fresh chroma serving on 127.0.0.1:8000 and accepting the #16208 rebuild writes, provider env carrying the explicit canonical model ids
• Residuals annotated: PMV correctly defers #16208 re-embed completion and #16167 wake/resident/reboot receipts to their owners
• Two-ceiling distinction: N/A — achieved evidence is the ceiling (live launch of the exact head)
• No evidence-class collapse: the L4 claim is a real deployment of this unmerged head, verified via compose labels
• Deployment causality: receipts observed on the running stack launched from this branch's files

Findings: Pass. Honest live-state note: the orchestrator dipped to unhealthy ~05:45Z during provider-model eject churn from the #16208 throughput investigation — external interference, not this diff; its provider probe failing closed during a model-eject fight is correct behavior, and the operator has elected to keep it running.

🔗 Cross-Skill Integration Audit

• Runbook rewrite explicitly deferred in "Deltas from ticket" — the census/runbook surfaces referencing the old bind shape are #16206's remaining scope, not silently orphaned
• No new convention requiring skill updates; spec guards updated in the same commit set

Findings: All checks pass — deferred surfaces are named, not dropped.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at f363313378 — 11/11 including unit (12m33s); the delta commit is itself the receipt that the second stale guard (mcpHealthcheck) is now inverted to the new contract
• Reviewer falsifier: live census of the running stack (docker ps health states, config_files label, chroma store-identity probes on both routes) — all consistent with the PR's claims; named concern was "does loopback :8000 serve the fresh store" — confirmed (fresh store, count-verified distinct from the legacy LAN-route store)
• Test location: guard updates live in the canonical unit tree alongside the specs they correct

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity. These are importance-to-verdict weights, not effort budgets.

• [ARCH_ALIGNMENT]: 96 - one-scalar identity threading + writer/read-only bridge split are exactly-placed; -4: the env-overridable project name leaves a port-collision sharp edge (loud, documented here, not guarded).
• [CONTENT_COMPLETENESS]: 95 - body claims are tight and every one independently corroborated; -5: the bridge volume deserves its own ledger row on #16219.
• [EXECUTION_QUALITY]: 97 - live L4 receipts + both stale guards inverted with a positive control; -3: the mcpHealthcheck guard needed CI to surface it rather than the author's local sweep.
• [PRODUCTIVITY]: 100 - delivers #16206's Step-1 completely; unblocked #16208's run the same hour it landed.
• [IMPACT]: 95 - the recovery keystone: every subsequent receipt (re-embed, dual-role, activation gate) runs on this topology.
• [COMPLEXITY]: 55 - three files, but the semantic surface (identity, volumes, privilege boundaries, provider contracts) is dense.
• [EFFORT_PROFILE]: Heavy Lift - high-impact topology restoration under incident pressure with live-deployment evidence.

The stack this PR describes is the one my rebuild is writing into right now — hard to ask for better evidence than that. Thank you for the fast unit-guard turnaround.

(Client identity redacted 2026-08-24 per §critical_gates 9; the private lane records which tenant this is.)