Prove Fleet cockpit bridge controls via Neural Link

Context

Lane 2/C of the post-v13.1 goal-scope is the NL/MCP live wiring leg under Ada's Fleet Manager Lane 2 ownership. The public contract is in #14561. #14509/#14510 shipped the dev-server app↔fleet transport and proved the wire below the DOM; this ticket turns that into a Neural-Link/whitebox proof for the cockpit interaction loop.

The operator-facing bar is not "the service exists." It is "@tobiu starts one agent from the UI instead of a terminal" and the cockpit settles or rejects honestly.

The Problem

The current code has the core bridge and minimal UI controls, but the Fleet Manager product story still needs a live proof that:

• the cockpit control invokes the bridge method generated from FLEET_WIRE_METHODS;
• the UI renders pending, success, and failure from actual bridge responses;
• missing bridge state degrades to gated instead of inventing success;
• Neural Link can inspect the live app state that the operator sees.

Without this proof, the cockpit can regress into a static form surface while still passing service-level tests.

The Architectural Reality

• learn/agentos/NeuralLink.md defines Neural Link as the live App-Worker possession bridge and verification surface.
• ai/mcp/server/neural-link/openapi.yaml exposes the runtime inspection/mutation operations used by whitebox e2e.
• src/ai/fleet/createFleetRegistryBridge.mjs creates the App-Worker bridge methods from FLEET_WIRE_METHODS.
• ai/services/fleet/dispatchFleetRequest.mjs normalizes bridge success/failure into {ok,result|error}.
• apps/agentos/view/FleetSettingsPanel.mjs currently calls registryBridge.startAgent/stopAgent/restartAgent and marks missing bridge as gated.
• test/playwright/e2e/NeuralLink*.spec.mjs contains the existing e2e pattern for connecting to a live app via the Neural Link fixture.
• Structure-map gate: ran npm run --silent ai:structure-map -- --files --loc; relevant owning folders are apps/agentos, src/ai/fleet, ai/services/fleet, ai/mcp/server/neural-link, ai/services/neural-link, and test/playwright/e2e.

The Fix

Add a whitebox/e2e proof for the Lane 2/C control round-trip:

1. Mount the AgentOS app with the fleet bridge injected or test-double-backed at the App-Worker boundary.
2. Use Neural Link / whitebox access to locate the Fleet Manager control surface and invoke a start/stop/restart path through the UI.
3. Assert pending and settled row state from actual bridge responses.
4. Assert failure and missing-bridge states degrade to explicit error/gated state.
5. Prove no PAT or credential payload is exposed to the Body during the control round-trip.

Contract Ledger Matrix

Decision Record impact

Aligned with ADR-0020 Agent Harness and the Neural Link possession-interface model. No ADR amendment expected.

Acceptance Criteria

• A Neural-Link/whitebox e2e or equivalent existing e2e fixture mounts AgentOS and connects to the live app.
• The test drives at least one lifecycle control through the UI and observes state update from a bridge response.
• The test covers a rejected bridge call or missing bridge and verifies explicit degraded state.
• The test proves the UI sends agent id/minimal operation payload only, never PAT/credential data.
• The proof uses the existing FLEET_WIRE_METHODS / registry bridge seam rather than a bespoke test-only control path.
• The test command is documented in the PR body when implemented; do not run default npx playwright test.

Out of Scope

• Adding new Fleet Manager control verbs.
• setWakeEnabled (#14537), which needs control-plane authority first.
• Redesigning the cockpit UI (#14560).
• Docking demo ownership under #13158; this proof may share NL primitives later but does not claim that lane.
• Electron shell in-process injection (#13033); the dev-server bridge remains acceptable for this proof unless Ada's Lane 2 decomposition changes the target.

Avoided Traps

• No DOM-only smoke test that misses App-Worker state.
• No service-only test pretending to prove the cockpit.
• No optimistic "running" state without returned bridge evidence.
• No test-only method outside the production bridge allowlist.

Related

#14561 · #13015 · #14509 · #14510 · #14560 · #14537 · #13080 · #13158

Live latest-open sweep: checked latest 20 open issues immediately before creation; no equivalent found. A2A in-flight sweep: checked recent mailbox claims before creation; Ada accepted GPT's Lane 2/C sublane, no competing claim found. KB/local duplicate sweep: surfaced #14509/#14510 and #13080 as shipped prerequisites; this ticket covers the live NL/whitebox proof still missing after the transport PR. Origin Session ID: 33403f62-0332-411a-bda3-0f4ab10cd1e6 Retrieval Hint: "Fleet Manager Lane 2/C Neural Link whitebox proof registryBridge startAgent gated state"