Resolves #16932

Operator directive, prio 0, issued after the Gemini API key was deleted: ask must stop defaulting to a metered cloud model, and gemma-4-31b-it must go.

Evidence: L4 (both defects measured against the live config with a probe, not inferred; the regression arms mutation-verified) → L4 required.

Two defects, and they had to ship together

The default billed a cloud provider. askSynthesis declared provider: leaf('gemini') + model: leaf('gemini-2.5-flash'), so every ask_knowledge_base call was metered by nobody's decision — ~EUR 70/month steady-state — behind a dedicated key a peer then exposed. That key is now deleted, so on dev the ask path is not merely expensive, it is broken.

The block already carried cost-safety machinery: a 20/min runaway breaker, a dedicated env-only key, a per-path budget cap. Every one of those bounds a metered call. None removes the meter, and none survives a leaked key. The default is now local; remote synthesis is preserved unchanged behind NEO_KB_ASK_PROVIDER + NEO_KB_ASK_API_KEY, so cloud spend costs a deliberate act instead of silence.

And the local path could never have worked. SearchService built its provider config by spreading the AiConfig node. Measured against the live KB config:

kbConfig.openAiCompatible.host      ->  http://127.0.0.1:1234
{...kbConfig.openAiCompatible}      ->  {}
what SearchService actually built   ->  {"model":"google/gemma-4-26b-a4b"}   // no host

An AiConfig node is a Neo.state.Provider proxy: get walks the parent chain, ownKeys (Provider#getTopLevelDataKeys, src/state/Provider.mjs:676) enumerates local #dataConfigs only. These leaves live on the Tier-1 root, so from the Knowledge Base child every named read is correct and every enumeration is empty. The spread silently dropped host, leaving OpenAiCompatible to fall back to its class default http://127.0.0.1:8000 — Chroma's port. A chat request aimed at a vector database.

This was invisible while the default was gemini, which ignores that object entirely. Switching the default to local is exactly what surfaces it — so shipping the switch alone would have shipped a broken ask. Both are fixed here; the four leaves buildChatModel consumes are now read at the use site.

Two credential leaks of one shape — and I created the second while fixing the first.

NEO_KB_ASK_API_KEY is a Gemini credential; my first pass forwarded it into the OpenAI-compatible branch, aiming a cloud key at a local LM Studio. I fixed that and called the boundary closed. It was not. With a Tier-1 coordinate of https://managed.example + sk-remote, the documented local override NEO_KB_ASK_BASE_URL=http://127.0.0.1:1234 moved the host while leaving sk-remote attached — so the transport emitted Authorization: Bearer sk-remote at a local server. @neo-gpt reproduced it against the real provider factory.

The rule from his review, which I did not have: a host and its credential are one coordinate. An own-endpoint override is by definition not the Tier-1 endpoint, so the key travels with its own host or not at all. Empty is the safe default — an endpoint that needs a credential fails loudly, while a wrong credential leaves silently.

The construction is now an exported pure buildAskProviderConfigs, so the pairing is driven on the producer. Asserting it through SearchService alone would mean recomputing the expected value inside the test — proving the arithmetic, not the contract, which is exactly the producer-blind fixture that let a broadcast-only resolver survive review on #16918 the same night.

31b

LM Studio and MLX JIT-load whatever id they are handed, so a stray gemma-4-31b-it is not a naming inconsistency — it is a load instruction for a ~20 GB dense model. Observed live: 31b and 26b resident simultaneously, 31b holding a 60-minute idle TTL, against the 26b that was chosen on measured performance grounds.

Removed from every consumable position: the MLX task leaf, both parity Compose profiles, the parity-latency diagnostics script, the mock server's chat fallback, and the OpenAI-compatible provider's class default. That last one was an Ollama-namespaced id sitting in the OpenAI-compatible provider — an id no OpenAI-compatible server can serve, so a caller that omitted modelName never got a working fallback, it got a request for a model that does not exist. It is now null, so the omission fails loudly instead.

The recurrence fix — because the string was never the mechanism

Removing gemma-4-31b-it stops one spec loading one wrong model. It does not stop the next spec loading the next one. The mechanism was the guard.

Two specs that drive a real model server carried test.skip(!!process.env.NEO_TEST_SKIP_CI, …) — skip in CI, run everywhere else. Everywhere else is the operator's machine: models loaded, real Chroma, finite RAM. CI, which has none of that and nothing to lose, was the only environment exempted. Same shape as skipping on a missing API key — the condition meaning "unsafe to run here" wired as the condition to skip, so the guard fired precisely where running was harmless.

Both now default OFF everywhere and opt in via NEO_TEST_LIVE_MODELS=true. Coverage is preserved for anyone who has deliberately provisioned a model server; what is removed is a routine npm run test-unit doing live inference against whatever LM Studio happens to be listening.

Two scoping corrections, recorded because each would have shipped a large confident wrong change:

The headline number was wrong. 30 specs carry the inverted guard — but only four reach a live service, and only two reach a model server. The other 26 skip CI for slowness, which is legitimate and unrelated. GraphService and ChromaRecovery touch Chroma, which the unit harness already isolates by construction on a run-scoped free port. Acting on "30" would have been decisive and wrong.

The new guard's first version was a false-positive machine. It flagged every spec merely naming a model port and reported 18 — almost all config-assertion specs (configBase.spec.mjs, generateKimiSeatConfig.spec.mjs) that carry the host as expected data and never open a socket. Gating those would disable real coverage for zero safety gain. The signal is the pair: reaches a model host and uses the skip-in-CI guard — because that pair means the author already knew live services were needed and reached for the backwards guard to say so.

Mutation-verified: restoring the inverted guard on KeepAlive.spec.mjs fails the new arm and names that file. Non-vacuity asserts both halves of the pair are detectable independently, so an empty offender list cannot mean one matcher went blind.

Source-level rather than behavioural, deliberately: the failure is a spec doing something to a machine CI does not have, so CI is structurally incapable of observing it. Reading the guard is the only check that runs where the defect is invisible.

The "flake" that was deterministic — and why it is in this PR

I could not honestly claim the guard change leaves a clean suite while the full run kept failing, so I chased the failure instead of asserting around it.

seatCostReport.spec.mjs created its fixture directory with a module-scope mkdtempSync and called writeSyntheticFixtures() beside it at import time, while cleanup was a top-level test.afterAll. Two different lifecycles, with nothing tying the directory's existence to the window the tests needed it. The two CLI arms spawn a child process that reads through that directory, and it died on ENOENT … /seatcost-fixtures-XXXXXX/kimi-wire.jsonl. Every run also leaked one uncleaned temp dir — 52 had accumulated on this machine.

It was never flake. It failed in every full-suite run and passed in isolation, which is exactly why it read as noise — including to me, three times in one night, each time as grounds for calling my own PR's red "not mine". Deterministic; it simply needs enough sibling files in the worker to surface.

The one remaining failure (ResizeObserver.spec.mjs:302) is Body-layer, unrelated, and present on a clean tree.

That distinction matters beyond this file: a suite cannot be safely parallelized or path-scoped while reproducible failures are dismissed as flake — and CI running at workers: 1 (playwright.config.unit.mjs:190, with no comment justifying it, 60 lines below one stating the global should stay "wide for the bulk-parallelism win") is what trains everyone to dismiss them.

Deltas from ticket

Retained deliberately, against a literal reading of "all occurrences": prose recording why 26b was chosen over 31b, and a dated benchmark in MemoryService. Deleting the rationale for a decision is not the same as removing the value, and rewriting a dated measurement would falsify it. Likewise the ~180 references across resources/content/archive/** are historical records of what was said at the time.

AC-5 is stronger than the ticket asked. The obvious arm pins provider: 'openAiCompatible'. That would still pass with a remote model id left in the model leaf — which is precisely how this drifts back, because a provider flip is visible in review and a model-id string edit is not. The arm asserts the id, and a second arm rejects any gemini-* / gpt-* / claude-* default appearing anywhere in the block.

AC-6 cross-checks two files. The ask model id must equal the Tier-1 openAiCompatible.model id. Different ids are not a preference — they mean a second resident chat model.

Test Evidence

3109 passed across ai/daemons/orchestrator/, ai/deploy/, ai/services/knowledge-base/, ai/services/graph/, ai/mcp/server/knowledge-base/, ai/scripts/runners/, ai/services/memory-core/helpers/ via npm run test-unit; 14 passed in AskSynthesisConfig.spec.mjs.

The one spec that failed before I updated it — "defaults to the fast remote gemini provider" — was the contract arm pinning the old behaviour. It now pins the opposite, which is the honest form of that change rather than a deletion.

Post-Merge Validation

• ask_knowledge_base answers on a plane with no NEO_KB_ASK_API_KEY set.
• LM Studio holds exactly one chat model after a full local suite run.

Evolution

The spread defect here is the second instance tonight of the same substrate hazard — the first killed mc-server at boot in #16918. Both were invisible for the same reason: an AiConfig spread returns {} silently, and in each case a different default masked it (a gemini provider here, a plain-object test fixture there). It is worth knowing that materializing an AiConfig node is not a style violation but lossy by construction.

The deeper finding this came out of is not in this PR's scope: 30 unit specs carry test.skip(!!process.env.NEO_TEST_SKIP_CI, …), which skips in CI and therefore runs only against an operator's live LM Studio and Chroma. That is how a unit test came to dictate deployment model policy, and it is the same inversion as test.skip(!API_KEY).

Authored by @neo-opus-grace (Opus 5)