Detect harness MCP/bridge processes running stale (pre-merge) code

Context

Surfaced during a V-B-A on #13286 (NL-undo no-writer-identity) on 2026-06-15: the running neural-link bridge process predated the #13167 transport merge, so it executed pre-emit code in memory → no-writer-identity. Node does not hot-reload; a long-lived MCP process keeps running the code it loaded at boot.

Correction (premise falsified + rescoped — 2026-06-15)

The original premise — "there is currently no freshness signal" — was wrong, caught by structural-pre-flight on the shared MCP layer before any code was written. ai/mcp/server/shared/services/RuntimeFreshnessService.mjs already exists: a shared, cloud-safe, digest-based boot-vs-current freshness service (the realized form of #12778's gitHead-coupling removal — config/OpenAPI SHA-256 digests drive status:'stale', gitHead is contextual-only, cloud services omit rootDir). It is wired into Memory Core, Knowledge Base, and GitHub Workflow healthchecks. The GitHub issue dup-sweep is issue-tracker-only and could not surface an existing service. This ticket is rescoped to the actual residual gap.

The Problem (rescoped)

The freshness infrastructure exists, but two gaps let the #13286 stale-process class escape:

1. neural-link is NOT a consumer. ai/services/{memory-core,knowledge-base,github-workflow}/HealthService.mjs each build a RuntimeFreshnessTracker; neural-link builds none — so the bridge has zero freshness tracking.
2. The digest set covers config + OpenAPI schema only, NOT behavioral source code. Each consumer digests configDigest + openApiDigest (verified: ai/services/*/HealthService.mjs). A source-CODE change (e.g. the Bridge.mjs agent_message emit) does not flip stale on ANY server. So the exact #13286 class — a merged .mjs behavior change not running in a long-lived process — is undetected everywhere, not only on the unwired bridge.

The Fix

• (a) Wire neural-link to RuntimeFreshnessService via a neural-link HealthService tracker, mirroring the three existing consumers. Concrete, pattern-matched. (Note: (a) alone would NOT have caught #13286 — the emit was a code change, and (a) only adds config/schema digests for the bridge.)
• (b) Cover source-code staleness cheaply. The actually-#13286-addressing part: detect that a long-lived process is running pre-merge code, without the gitHead-cloud trap (#12778) or an expensive per-file source digest (the schema-tax discipline). Candidate mechanisms — a single build/bundle digest, a boot-time-vs-source-mtime check, or a coarse source-tree digest — are genuinely ambiguous and cross-harness, so (b) is an Ideation Sandbox candidate, not a settled prescription.

Contract Ledger Matrix

Acceptance Criteria

• (a) neural-link's healthcheck surfaces RuntimeFreshnessService status (config/OpenAPI digests), mirroring MC/KB/GH-Workflow.
• (b) [design-gated] a cheap, cloud-safe signal flips stale when a long-lived server runs pre-merge source code — OR (b) graduates to an Ideation Sandbox Discussion to settle the mechanism first.

Decision Record impact

none. Aligned-with the existing RuntimeFreshnessService + #12778 (gitHead-removal / digest-based, cloud-safe). This EXTENDS that service's coverage and wiring; it does not rebuild it.

Out of Scope

• Rebuilding freshness detection (it exists — RuntimeFreshnessService).
• The immediate #13286 operational fix (restart the live bridge — operator-gated, tracked on #13286).
• The (b) mechanism decision if it routes to an Ideation Sandbox.

Avoided Traps

• gitHead / SHA-vs-HEAD freshness — cloud-hostile, removed in #12778; RuntimeFreshnessService already uses digests and keeps gitHead contextual-only. (b) must stay on that side of the line.
• Expensive per-file source digest — a code-staleness signal must stay cheap (a single bundle/build digest or an mtime check), not an O(files) hot-path enumeration.

Related

• #13286 (incident), #13167 (the merged transport masked by the stale process), #12778 (gitHead-removal → the cloud-safe digest design RuntimeFreshnessService embodies), #13012 (Agent Harness epic), and the existing ai/mcp/server/shared/services/RuntimeFreshnessService.mjs + ai/services/{memory-core,knowledge-base,github-workflow}/HealthService.mjs.

Evolution

Filed 2026-06-15 with a falsified "no freshness signal" premise. Structural-pre-flight on the shared MCP layer caught RuntimeFreshnessService before any code was written; rescoped here to the real coverage/wiring gap. Process lesson: for infra/mechanism tickets, grep the codebase for an existing mechanism before filing — the dup-sweep is issue-tracker-only and cannot surface an existing service.

Live latest-open sweep: checked latest 20 open issues at 2026-06-15T01:38Z; no equivalent found. Release classification: post-release (Agent Harness infra reliability; not v13-blocking) — boardless.

Origin Session ID: 0f5d9f1d-0683-452d-aac1-f467297186ac

Authored by Claude Opus 4.8 (Claude Code), @neo-opus-grace (Grace).