Deployed healthcheck + production-shaped journey proof

Context

Sub D of Epic #11720 (Cloud Agent OS Deployment Readiness). MVP-critical. Blocked-by D0 #11721 (topology decision).

The Problem

KB/MC compose services define no Docker-level healthcheck: blocks; there is no production readiness contract; the MCP servers expose no plain /healthcheck HTTP route; there is no orchestrator-in-stack health proof. Streamable-HTTP MCP healthcheck integration tests already exist (test-integration-unified) — the gap is production-profile readiness semantics + the operator-journey proof, not generic "more tests."

The Fix

Define KB/MC container readiness semantics + the deployed healthcheck (covering the MCP servers + the orchestrator/scheduler profile, not just ChromaDB) + the production-shaped operator-journey proof.

Three distinct test-evidence lanes — kept distinct (per @neo-gpt's #11718 test-strategy, DC_kwDODSospM4BA4Rx): (1) CI-safe deterministic regression — mocks / fixtures / dockerized services; NO heavyweight local-model (SLM / Gemma-class) inference in default GitHub Actions (.github/workflows/test.yml NEO_TEST_SKIP_CI precedent — SessionSummarization.spec.mjs already skips heavy-SLM coverage under it); (2) heavyweight local/docker provider proof guarded behind a skip / manual workflow; (3) the manual real-world harness deployment demo.

The journey proof = the incremental adoption ladder (Milestone 0 runnable SSE healthcheck demo → 1 MC connection → 2 KB connection → 3 tenant ingestion → 4 client-side parser → 5 bulk/backfill → 6 optional clone → 7 backup→redeploy→handoff), each milestone independently verifiable. Include the cloud-profile negative-behavior assertions — no git pull origin/dev, no local worktree discovery, no .sync-metadata.json reset, no local-checkout KB-sync cascade.

Acceptance Criteria

• KB/MC container readiness semantics defined (an MCP JSON-RPC healthcheck probe satisfies container readiness — no mandatory new HTTP route).
• Docker healthchecks on the kb-server / mc-server compose services + an orchestrator-in-stack health proof.
• The 3 test-evidence lanes implemented + separated; default CI carries no heavy-SLM path.
• The incremental adoption-ladder journey proof (Milestone 0–7).
• Cloud-profile negative-behavior assertions pass.
• Cloud-profile negative-behavior assertions also cover wake/A2A delivery — the deployed profile asserts local wake-delivery is disabled / no-op / tenant-bound, not only the dev-sync negatives. [scope refinement — #11718 completeness audit]

Out of Scope

• Generic "add more tests" — existing integration coverage is solid; this sub is the production-profile readiness + journey proof.

Related

Parent #11720 · blocked-by #11721 (D0) · Origin Discussion #11718 §8 + GPT test-strategy DC_kwDODSospM4BA4Rx + the test-evidence-lane addendum · #10945 / #10950 (deployment-test substrate) · #11003 (Dockerized remote MCP transport proof).

Origin Session ID

8e1dc8ca-b5a5-4479-b3cf-31918eb4a5b2