Recover active-provider model residency through recovery daemon

Context

#13941 fixes the local LM Studio preload/residency side of #13700, but that does not cover cloud deployments where the active local-model provider is native Ollama and there is no macOS/LM Studio surface. The same failure class must be handled by the deployment immune system: ADR-0025 diagnoses active-provider/runtime faults, and ADR-0026 recovery consumes that diagnosis through the lowest-privilege actuator that can reach the faulting unit.

Release classification: deployment-recovery hardening under #13874; boardless unless the operator promotes it to a deployment-readiness gate.

Live latest-open sweep: checked latest 20 open issues at 2026-06-24T08:51:14Z. Related but non-equivalent tickets: #13874 (recovery daemon epic), #13914 (read-only deployment observability MCP tool), #13936 (live deployment closeout smoke), #13852 (local-dev native-Ollama serve/context lifecycle), #13700 (LM Studio parallel/cache issue). A2A in-flight sweep over latest 30 messages at 2026-06-24T08:51:14Z returned 0 messages.

The Problem

The existing provider-readiness helpers can warm or classify configured models, and #13941 improves LM Studio stale-resident replacement. That is still a boot/readiness adapter fix, not the deployment recovery architecture.

When the active provider is native Ollama in a cloud stack, the recoverable fault is a runtime/provider residency condition: wrong or missing required model, loaded context below the configured cap, stale extra residents consuming capacity, resident-but-not-serving runner, CPU/memory saturation, or a wedged external model container. If all model threads are frozen, graph-only evidence may not update. The recovery daemon must consume direct diagnostics and act through the configured provider/runtime boundary, not through an LMS-specific helper.

The Architectural Reality

• ADR-0025 (learn/agentos/decisions/0025-orchestrator-container-health-self-healing.md) owns detect + diagnose: multi-fact evidence, symptom-to-cause mapping, and typed diagnosis events. It explicitly separates health signal from actuator authority.
• ADR-0026 (learn/agentos/decisions/0026-recovery-actuator.md) owns heal + act: diagnosis -> controller -> bounded actuator action with B0 supervised-process recovery and B1 allowlisted deployment-runtime actions.
• ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.mjs already maps runtime observations into recovery-diagnosis events and has Ollama contention hooks.
• ai/daemons/orchestrator/services/RecoveryActuatorService.mjs already consumes diagnosis events and writes recovery-run traces through the ADR-0026 envelope.
• ai/services/graph/providerReadinessHelper.mjs already has provider-specific LMS and Ollama readiness/probe primitives, but a helper-level boot preload is not the recovery daemon.
• ADR-0019 applies: read resolved AiConfig leaves at the use site; do not create hidden defaults, convert typed leaves, pass config subtrees across modules, or re-derive config from env.

The Fix

Add an active-provider model-residency diagnosis/recovery path under the recovery daemon:

1. Diagnostics resolve the active local-model provider from AiConfig leaves at the use site and collect provider-specific facts:
   • LM Studio/OpenAI-compatible local: lms ps --json shape facts where available.
   • Native Ollama: /api/ps, native role/model context facts, serving/progress attribution, and container resource observations.
2. Diagnostics emit a typed ADR-0025 diagnosis for provider-residency faults: required/loaded model ids, role, context length, parallel/equivalent capacity, stale/extra residents, resident-but-not-serving evidence, CPU/memory saturation, and target identity.
3. Recovery maps the diagnosis to the lowest-privilege ADR-0026 action:
   • B0 when the active provider is an orchestrator-supervised child that can be recycled/restarted by ProcessSupervisorService.
   • B1 when the active provider is an external compose service reachable only through DeploymentRuntimeAccessService allowlisted lifecycle actions.
   • Escalate-with-diagnosis for config drift, unsupported provider, ambiguous evidence, or any case where ownership of stale residents cannot be proven.
4. Re-observe after action and record the outcome in the recovery-run ledger. The public proof path remains #13914/#13936; this ticket owns the daemon decision/action seam.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR-0025, ADR-0026, and ADR-0019. This ticket does not amend the ADRs; it adds the missing active-provider residency fault class to the already-approved diagnostics -> recovery architecture.

Acceptance Criteria

• The daemon diagnoses active-provider residency faults for both LM Studio/OpenAI-compatible local and native Ollama without hardcoding one provider as the architectural default.
• Native Ollama diagnosis uses direct provider/runtime facts (/api/ps/role attribution/container observations), not LM Studio commands and not graph-only evidence.
• Recovery selects B0 vs B1 strictly from the diagnosed target identity and the ADR-0026 privilege envelope.
• Config drift, unsupported provider, ambiguous evidence, and unowned stale residents escalate with diagnosis instead of looping a recovery action.
• Tests cover LMS observation, Ollama observation, B0 routing, B1 routing, escalate/no-act routing, re-observe outcome recording, and anti-thrash/allowlist refusal.
• No ADR-0019 regressions: no hidden defaults, no type conversions for typed config leaves, no config subtree pass-through, no env rereads.
• #13914/#13936 can use the resulting diagnosis/recovery-run evidence in the deployment smoke path.

Out of Scope

• Phase-2 homeostatic downscaling/upscaling (#13873).
• A new public privileged MCP route; public surfaces stay KB/MC and read-only for this proof path.
• Changing deployment config values or private deployment templates.
• Re-opening the closed Ollama readiness/reporting slice #13879.
• Replacing the narrow LM Studio fix in #13941.

Avoided Traps

• Do not make providerReadinessHelper.mjs the recovery controller.
• Do not add LMS-only recovery logic and call it cloud-ready.
• Do not use graph-only evidence for a fault class where the model provider may be wedged before graph writes can occur.
• Do not expose socket/shell/restart authority through public MCP surfaces.
• Do not blindly unload stale resident models unless orchestrator ownership is proven.

Related

Parent: #13874. Depends on diagnostics substrate from #13860 / ADR-0025 and recovery substrate from ADR-0026. Related: #13700, #13941, #13852, #13879, #13914, #13936, #13873.

Origin Session ID: 2404e510-ad73-429d-bec8-5583ec83ba70

Handoff Retrieval Hints: active-provider model residency recovery daemon Ollama LM Studio ADR-0025 ADR-0026, provider residency diagnosis targetIdentity B0 B1 recovery actuator