Enable deployment-state bridge by default with opt-out

Context

#13936 is the live deployment immune-system smoke gate. Repeated KB/MC-only probes show the public read tools are present, but the deployment-state snapshot remains absent. A fresh check on 2026-06-25 found the likely root: the orchestrator-side writer is disabled by default, and the running orchestrator had no NEO_DEPLOYMENT_STATE_BRIDGE_ENABLED override.

Release classification: deployment-readiness hotfix, boardless unless the operator attaches the deployment closeout lane to the active release board.

Live latest-open sweep: checked the latest 20 open issues on 2026-06-25; no equivalent default-enabled deployment-state bridge ticket found. Search sweep for deployment-state bridge enabled default opt-out snapshot-missing found #13936 only, which is the smoke/closeout gate rather than the implementation fix. A2A in-flight sweep: list_messages({status: 'all', limit: 30}) found no competing lane claim for this scope.

The Problem

The public KB/MC deployment-inspection tools can only prove the live deployment state if the internal orchestrator holder writes the snapshot. Today the writer is opt-in:

• ai/config.mjs and ai/config.template.mjs define AiConfig.orchestrator.deploymentStateBridge.enabled as leaf(false, 'NEO_DEPLOYMENT_STATE_BRIDGE_ENABLED', 'boolean').
• DeploymentStateBridgeService.writeSnapshotIfDue() returns status: 'disabled' before collecting or writing anything when that leaf is false.
• The KB/MC tools then correctly report snapshot-missing, but #13936 cannot close because there is no snapshot to inspect.

That creates the same deployment trap we have been removing elsewhere: the system has a fire-status surface, but the useful proof is disabled unless an operator knows one more environment variable. The intended deployment contract should be easy: diagnosis/recovery observability is on by default, and operators opt out explicitly if a deployment has a reason to suppress it.

The Architectural Reality

The security boundary remains intact if this is done at the existing layer. KB and MC only read a bounded file through get_deployment_state_snapshot / inspect_deployment; they do not receive Docker socket, shell, exec, restart, or actuator authority. The privileged collection stays inside ai/daemons/orchestrator/services/DeploymentStateBridgeService.mjs, which already reads through the internal runtime access service and writes through ai/services/memory-core/helpers/deploymentStateBridgeStore.mjs.

The risky part is not enablement itself; it is payload scope. The default-enabled snapshot must stay bounded and safe: known runtime/deployment surfaces only, no new public privileged route, size cap enforced, and opt-out available through NEO_DEPLOYMENT_STATE_BRIDGE_ENABLED=false.

The Fix

Switch the deployment-state bridge from opt-in to enabled-by-default, preserving explicit opt-out. Review the default service/log payload at the same time so enabling the writer by default does not broaden public data exposure beyond the existing bounded contract.

Candidate touchpoints:

• ai/config.template.mjs
• ai/config.mjs
• test/playwright/fixtures/aiConfigDefaults.mjs
• test/playwright/unit/ai/config.template.spec.mjs
• deployment-state bridge unit coverage around disabled opt-out and default write behavior

Contract Ledger

Decision Record impact

Aligned with ADR-0019, ADR-0025, and ADR-0026. This should not amend the ADRs unless implementation discovers the ADR text still implies opt-in observability.

Acceptance Criteria

• Deployment-state bridge writer is enabled by default through AiConfig, with an explicit false env override still supported.
• Default payload remains bounded and does not expose a new public privileged surface; KB/MC remain read-only consumers.
• Tests cover default-enabled behavior and explicit disabled opt-out.
• Config template/spec/default fixtures remain in sync.
• Post-merge validation: restart orchestrator + KB/MC, then #13936 KB/MC-only smoke observes status: available or a meaningful stale/degraded status instead of snapshot-missing.

Out of Scope

• Adding shell, Docker socket, restart, exec, or actuator authority to KB/MC.
• Changing the recovery actuator task policy.
• Closing #13936 without a live KB/MC-only smoke.
• Publishing private deployment configuration values.

Avoided Traps

• Do not solve this by adding more mandatory deployment guide steps if the product contract can be default-on with opt-out.
• Do not make the public tools privileged; keep authority inside the orchestrator holder.
• Do not treat snapshot-missing as a successful smoke.
• Do not mention deployment-specific private details in public artifacts.

Related

Related: #13936, #13926, #13914, ADR-0019, ADR-0025, ADR-0026.

Origin Session ID: 1c4b42c3-289a-4196-bec0-36a3a9f16fa6

Retrieval Hint: deployment-state bridge enabled default opt-out snapshot-missing #13936