Container-health daemon design/ADR: actuator + heal-safety + detect

Context

Sub of #13860 (orchestrator container-health self-healing daemon). This is the design-first, cross-family-gated sub: it resolves the three hard decisions and produces an ADR before any implementation sub is built. A self-acting privileged auto-healer is safety-critical — the actuator design must be settled and cross-family-reviewed first; it gates the detect / act / deploy subs.

The decisions to resolve

1. Actuator privilege model (greenfield — no container-control precedent in ai/). For the orchestrator container to restart a sibling, it needs a container-runtime handle. Options to weigh (≥2, each with a falsifier): (a) docker-socket mount + a constrained action-set wrapper; (b) a minimal-scope privileged sidecar; (c) the runtime's own health-restart mechanisms where they exist. Safety must live in the action set, not the access.
2. Heal-safety bounds. Rate-limit, N-attempt cap, escalate-on-repeat threshold, reversibility guarantee, and the lifecycle-only constraint (config/restart, never code — the two-worlds boundary). Must include an argument that a buggy heal loop cannot thrash the deployment worse than the fault.
3. False-positive-safe detect model. How to distinguish "actually broken" from "a probe false-fails while the service is functionally fine" (the model-dependent-canary case). Which signals are authoritative (resource/contention reality) vs advisory (single probes), and deployment-aware alarming thresholds (not over-strict).

Deliverable

An ADR capturing the actuator model + heal-safety bounds + detect model, with a divergence matrix (≥2 options per axis, falsifiers) for the actuator decision. Cross-family /peer-role review required before it resolves.

Acceptance Criteria

• Divergence matrix for the actuator privilege model (≥2 options, ≥1 falsifier each).
• Heal-safety bounds specified (rate-limit, N-cap, escalate threshold, reversibility, lifecycle-only) with a thrash-impossibility argument.
• False-positive-safe detect model specified (authoritative vs advisory signals; deployment-aware thresholds; the model-dependent-canary case handled).
• ADR filed + cross-family /peer-role reviewed.
• The implementation subs (detect / act / deploy) are unblocked by the resolved design.

Out of Scope

• The implementation itself (detect / act / deploy) — separate subs, gated by this design.

Related

Parent epic #13860. Precedents: ProcessSupervisorService (in-process supervision analog), remConsolidationLivenessWatchdog / embedDrainLivenessWatchdog (watchdog pattern), HealthService (probe source).

Origin Session ID

2439c28b-245e-425a-85a7-ca7ee4aa0336