KB + MC external-only + de-auto-trigger: orchestrator as single source of truth

Context

Post-unification (KB + MC share one orchestrator-owned Chroma daemon), both MCP servers still carry boot-time auto-trigger flags + managed-mode lifecycle surface that duplicate orchestrator responsibility. The orchestrator daemon already drives every one of these behaviors on its own schedule (per #12065): dream (1h), golden-path (1h), summary (10min), chroma (continuous + 24h recycle), kbSync, and FS-ingest (Phase 1 of the dream cycle). The MCP servers should be pure clients — no boot-time self-triggers, no managed-mode DB lifecycle, no autonomy tools the orchestrator owns.

Empirical smell: every SDK script (ai/services.mjs) and runSandman.mjs already hardcodes these flags to false defensively to prevent double-runs with the orchestrator. That "remember to disable it everywhere" tax is the signal — the flags are a redundant second source of truth.

Inventory (validated against source 2026-05-30)

Memory-Core auto-* flags — ai/mcp/server/memory-core/config.template.mjs

Knowledge-Base auto-* flags — ai/mcp/server/knowledge-base/config.template.mjs

MCP tools

The Fix

1. Delete all 9 boot-time auto-* config leaves (MC 7 + KB 2) + env bindings.
2. Remove the boot-hook code consuming the ACTIVE flags: SessionService:302,866, DreamService:128, GraphService:166 (MC); DatabaseService:557 (KB autoSync). Remove the dead realTimeMemoryParsing if-block (MemoryService:348). The two DEAD autoStartDatabase flags + DEAD autoStartInference have no hook — leaf + override deletion only.
3. Remove redundant MCP tools manage_database (both) + summarize_sessions (MC) — registration + handler/lifecycle methods. Keep mutate_frontier.
4. Simplify HealthService (both): drop the auto-* observability block (MC HealthService:441-456) + the managed/strategy DB branching → external-only payload.
5. Remove the now-meaningless defensive overrides: ai/services.mjs (KB:40,41; MC:63,64,65) + runSandman.mjs:98-100.
6. (PR B) Collapse the managed-mode lifecycle: lifecycle services → readiness gate / inline into ChromaManager.connect; drop unused spawn imports / chromaProcess; simplify the two ChromaManagers (lifecycle coupling removed, distinct client logic retained).

Staging (2 PRs)

• PR A — de-auto-trigger surface (mechanical): items 1-5. Pure removal; orchestrator already drives everything → no behavior lost. Low-risk.
• PR B — external-only Chroma lifecycle (refactor): item 6.

Contract Ledger

Acceptance Criteria

• All 9 boot-time auto-* leaves removed (MC 7 + KB 2) + env bindings.
• Boot-hook code removed (SessionService:302,866, DreamService:128, GraphService:166, KB DatabaseService:557) + dead realTimeMemoryParsing block.
• manage_database (both) + summarize_sessions (MC) removed; mutate_frontier retained.
• HealthService simplified (no auto-*/managed/strategy block; external-only).
• Defensive …= false overrides removed (ai/services.mjs, runSandman.mjs).
• Lifecycle services collapsed; ChromaManagers simplified (PR B).
• Full unit suite green; orchestrator confirmed sole driver of each behavior.

Out of Scope

• Orchestrator-side Chroma mechanisms (kill-dups PR #12137; recycle) — the supply side.
• The orchestrator REM pipeline itself (#12065 — already built the replacements).

Decision Record impact

aligned-with ADR 0003 (unified Chroma topology) — establishes the orchestrator as the sole lifecycle + autonomy authority for KB + MC.

Related

• #12065 (orchestrator REM pipeline — built the replacements)
• #12133 (dual-daemon corruption — redundant managed-mode was a factor) · PR #12137 (kill-dups)

Scope expanded 2026-05-30 per operator directive (KB added; summarize_sessions removal confirmed; mutate_frontier confirmed keeper) + full source-validated inventory. Filed by @neo-opus-ada.