Context
The deployment immune-system epics are not ready to close on code merge evidence alone. Live closeout comments on #13860, #13874, and #13889 all converge on the same residual: the cloud deployment still needs an L3/operator smoke proving that the deployed stack exposes current diagnosis/recovery state through the approved public surfaces.
Release classification: deployment-readiness closeout, boardless in this turn; promote to the active release/project board if the operator wants this smoke tracked as a release gate.
Live latest-open sweep: checked the latest 20 open issues on 2026-06-23; no equivalent dedicated deployment smoke/proof ticket found. A2A in-flight claim sweep: list_messages({status: 'all', limit: 30}) returned 0 messages. Duplicate keyword sweeps for open and closed issues returned no equivalent.
The Problem
#13860, #13874, and #13889 can each look structurally complete at L2 while still failing the operational question that triggered the emergency: can the deployed system prove and recover from a wedged model / unhealthy Memory Core state without relying on graph-only proof or private shell access?
Leaving that proof only in scattered PR post-merge checklists is fragile. It is easy to merge the code and never run the smoke that makes the parent epics legitimately closable.
The Architectural Reality
Public surfaces remain KB and MC only. Runtime authority remains inside the orchestrator deployment-runtime holder; KB/MC must not gain Docker socket, shell, exec, restart, daemon-route, or public write authority.
The current dependency chain is:
- #13926 / PR #13935 provides the graph-independent deployment-state bridge read by KB/MC.
- #13914 owns the public cloud-deployment observability MCP tool on top of the approved surfaces.
- #13860 needs public proof for diagnostics/current deployment state.
- #13874 needs controlled recovery proof for the privileged actuator/recovery-run path.
- #13889 needs deployed message-WAL drain parity proof for acknowledged A2A durability.
The Fix
Run and record one live deployment smoke after the required public-surface PRs land. The smoke should seed or observe a safe degraded-state fixture and verify the public MCP read path, recovery-run ledger, and message-WAL drain behavior without adding any new public privileged route.
Contract Ledger
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback |
Docs |
Evidence |
| KB/MC deployment-state public read path |
#13926, #13914 |
Read current bounded deployment-state snapshot through public tools only |
Missing/stale/unconfigured state is explicit |
PR bodies + tool schemas |
L3 live smoke transcript |
| Recovery actuator proof |
#13874, ADR-0026 |
Controlled allowlisted recovery action records recovery-run ledger + reobserve result |
Backoff/escalation is recorded, not silent |
Epic closeout comment + ADR-0026 |
L3 live smoke transcript |
| Diagnostics proof |
#13860, ADR-0025 |
Wedged/unhealthy service state produces diagnosis/current-state evidence visible remotely |
Graph unavailable does not erase KB proof path |
Epic closeout comment + ADR-0025 |
L3 live smoke transcript |
| Message-WAL drain parity |
#13889 |
Deployed drain host starts in intended mode, acquires sole drain lock, projects a seeded pending message WAL row, and survives restart |
Double-drain refuses or leaves row pending with explicit diagnostics |
Epic closeout comment |
L3 live smoke transcript |
Decision Record Impact
Aligned with ADR-0025 and ADR-0026. This ticket does not amend either ADR; it captures the remaining live-evidence gate required before closing the parent epics.
Acceptance Criteria
Out of Scope
- Adding a new public daemon, orchestrator route, shell, exec, restart, or Docker-socket MCP tool.
- Changing the actuator design or diagnosis thresholds.
- Implementing #13914 or #13926.
- Publishing private deployment configuration values in the public repo.
Avoided Traps
- Do not treat green CI as deployment proof.
- Do not close epics from L2 evidence when their own comments require L3/operator smoke.
- Do not prove the failure class through graph-only reads; the known outage class includes graph-unavailable / Memory Core-unhealthy states.
- Do not expose private deployment specifics or client names in public artifacts.
Related
Related: #13860, #13874, #13889, #13914, #13926, ADR-0025, ADR-0026.
Retrieval Hint: deployment immune-system live smoke closeout #13860 #13874 #13889 #13926 #13914
Context
The deployment immune-system epics are not ready to close on code merge evidence alone. Live closeout comments on #13860, #13874, and #13889 all converge on the same residual: the cloud deployment still needs an L3/operator smoke proving that the deployed stack exposes current diagnosis/recovery state through the approved public surfaces.
Release classification: deployment-readiness closeout, boardless in this turn; promote to the active release/project board if the operator wants this smoke tracked as a release gate.
Live latest-open sweep: checked the latest 20 open issues on 2026-06-23; no equivalent dedicated deployment smoke/proof ticket found. A2A in-flight claim sweep:
list_messages({status: 'all', limit: 30})returned 0 messages. Duplicate keyword sweeps for open and closed issues returned no equivalent.The Problem
#13860, #13874, and #13889 can each look structurally complete at L2 while still failing the operational question that triggered the emergency: can the deployed system prove and recover from a wedged model / unhealthy Memory Core state without relying on graph-only proof or private shell access?
Leaving that proof only in scattered PR post-merge checklists is fragile. It is easy to merge the code and never run the smoke that makes the parent epics legitimately closable.
The Architectural Reality
Public surfaces remain KB and MC only. Runtime authority remains inside the orchestrator deployment-runtime holder; KB/MC must not gain Docker socket, shell, exec, restart, daemon-route, or public write authority.
The current dependency chain is:
The Fix
Run and record one live deployment smoke after the required public-surface PRs land. The smoke should seed or observe a safe degraded-state fixture and verify the public MCP read path, recovery-run ledger, and message-WAL drain behavior without adding any new public privileged route.
Contract Ledger
Decision Record Impact
Aligned with ADR-0025 and ADR-0026. This ticket does not amend either ADR; it captures the remaining live-evidence gate required before closing the parent epics.
Acceptance Criteria
Out of Scope
Avoided Traps
Related
Related: #13860, #13874, #13889, #13914, #13926, ADR-0025, ADR-0026.
Retrieval Hint:
deployment immune-system live smoke closeout #13860 #13874 #13889 #13926 #13914