Immune-system local/cloud scoping: gate B1 docker-socket sibling-restart to cloud; keep bridge + data-integrity + B0 local

Context (V-B-A'd 2026-06-26)

The orchestrator scopes tasks by deploymentMode (config.mjs:389, defaults 'local') into three buckets: localOnly{} (local-on/cloud-off), cloudOnly{} (cloud-on/local-off, e.g. tenant-repo-sync), and "both" (ungated). See Orchestrator.mjs:61-90 (resolveDeploymentEnabled / resolveCloudDeploymentEnabled).

The 4 deployment-immune-system services — DeploymentStateBridge, ContainerHealthDiagnosis, DataIntegrityDiagnosis, RecoveryActuator — are in NEITHER bucket. They run local+cloud by omission, not a deliberate decision.

The decision (operator-confirmed 2026-06-26)

Split by what each half actually does:

• Keep LOCAL (genuinely "both"): the read-only DeploymentStateBridge snapshot (feeds the agent-facing get_deployment_state_snapshot / inspect_deployment tools — real local value); the data-integrity detect + in-process re-embed heal (local memory-core/chroma rot like cloud; in-process, no socket); the B0 in-process child recycle (the stuck-local-model-server class, #13900).
• Gate to CLOUD: the B1 docker-socket sibling-container restart. ADR-25's motivating case is "a sibling saturates and the human-repair path is unavailable" — the no-operator cloud scenario. Locally the operator is present and autonomously recycling a dev container is disruptive. B1 is the privileged tier (ADR-26 §2.2) and is likely dormant locally anyway (the socket resolves known compose labels a local non-compose run may lack), so gating it is low-risk hygiene that makes the implicit classification explicit.

Coordination

Interacts with ADR-26 §2.2 activation default (#13952: recovery actuator enabled-by-default, opt-out blocklists). This refines that for the B1 tier under deploymentMode==='local'. @neo-opus-grace owns the recovery actuator — coordinate before implementing.

Acceptance criteria

• B1 docker-socket sibling-container restart is gated off when deploymentMode==='local' (mirror the cloudOnly pattern, or an equivalent deploymentMode gate on the B1 path).
• Bridge + data-integrity detect/re-embed + B0 in-process recycle remain enabled in local mode.
• The classification is explicit (deliberate local/cloud/both), not "by omission".
• ADR-25/26 updated if the gating changes the documented activation default.

Refs ADR-0025, ADR-0026, #13952 (activation default), #14039 (epic), #14147 (sibling). Operator-confirmed direction. Authored by Ada (Claude Opus 4.8, Claude Code).