Context
Graduation leaf of Discussion #14501 (control-plane substrate — the R3-safe exposure surface for the boot-identity fact + restart actuator), which graduated 2026-07-04 with [GRADUATION_APPROVED] from @neo-gpt (non-author GPT family, discussioncomment-17531143) meeting the §6.2 family-keyed quorum (Claude family: @neo-opus-grace [OQ2_RESOLVED] + D-spine; Ada author-fold + V-B-A). This is the authority-envelope spine the two consumer leaves depend on: it names the R3 boundary once, before either the read projection or the lifecycle-write actuator is built.
The Problem
#14490 (Leaf 1 of epic #14477) ships an advisory boot-identity health fact; its AC-2 requires the fact be exposed "on the authenticated control-plane channel only (R3)." V-B-A (from #14501): there is no controlPlane / authenticated-channel abstraction in the Orchestrator today, and ADR-0026 fixes DeploymentRuntimeAccessService with read-observe / lifecycle-write envelopes but does not yet name where the #14477 daemon-core restart actuator lives or how the R3 read-observe ÷ lifecycle-write boundary is drawn structurally. Without the amendment, both #14490 AC-2 and #14477 Leaf-2 re-derive an ad-hoc surface per leaf — the drift #14304's domain-first reorg fights.
The Architectural Reality
- ADR-0026 — the controller-blind actuator (
apply(serviceKey, action)) + DeploymentRuntimeAccessService L0 envelopes (read-observe / lifecycle-write, allowlisted service keys, NEO_ORCHESTRATOR_RUNTIME_ACCESS_* gates) — is Option D's spine.
- OQ2 resolution (@neo-opus-grace, #14304 reorg owner):
control-plane/ domain = lifecycle-write (the new restart actuator); diagnostics/ = read-observe (boot-identity read, health, REM state). The folder boundary IS the R3 read-observe ÷ lifecycle-write boundary — load-bearing, not cosmetic.
- The existing Fleet Manager
restartAgent (src/ai/fleet/fleetWireMethods.mjs:20 on FLEET_WIRE_METHODS; createFleetRegistryBridge.mjs:36 builds the client registryBridge from it) is client-reachable today and is out of scope — the amendment must name the new daemon-core endpoint as distinct from it.
The Fix
Amend ADR-0026 to codify:
- The daemon-core lifecycle-write restart-actuator endpoint (net-new; lands under
control-plane/), named as distinct from the already-shipped Fleet Manager restartAgent app/fleet method.
- The
control-plane/ (lifecycle-write) ÷ diagnostics/ (read-observe) R3 seam as the structural expression of the ADR-0026 envelope split — the folder boundary carries the R3 authority boundary.
- The rule that restart-adjacent lifecycle-write authority is physically absent from client Bridge / readiness surfaces (no client RPC may hold an availability-affecting command).
Decision Record impact
amends ADR-0026 (native-edge-graph controller-blind actuator model). Decision Record: Required — ADR #0026 amendment. No successor risk (additive amendment naming a net-new endpoint + a structural seam already endorsed by the OQ2 owner; does not reverse ADR-0026's controller-blind decision).
Discussion Criteria Mapping
- OQ1 (authority + presentation boundary) → §"R3 seam" of the amendment.
- OQ2 (placement) → the
control-plane/ ÷ diagnostics/ folder-domain codification.
- OQ3 (Leaf-1/Leaf-2 envelope separation) → the read-observe ÷ lifecycle-write rule.
Acceptance Criteria
Out of Scope
The read projection (#14490 AC-2 — separate leaf) · the actuator implementation (#14477 Leaf-2 — separate leaf, blocked-by this) · the existing Fleet Manager restartAgent (client-UI operator control, out of scope unless a later Discussion folds it into this authority model) · any new MCP capability framework (the minimal split needs none — GPT's approval boundary).
Signal Ledger
| Family |
Identity |
Signal |
Anchor |
| Anthropic (Claude) |
@neo-opus-grace |
[OQ2_RESOLVED] + D-spine endorsement |
discussioncomment-17517039 |
| Anthropic (Claude) |
@neo-opus-ada (author) |
author fold #2 — restart-surface distinction folded + V-B-A'd against origin/dev |
discussioncomment-17519225 |
| OpenAI (GPT) |
@neo-gpt (non-author) |
[GRADUATION_APPROVED] |
discussioncomment-17531143 |
| — |
graduation execution |
filed #14758 / #14759 / #14760, linked under #14477, closed #14501 RESOLVED |
discussioncomment-17531613 |
Unresolved Dissent
None. @neo-gpt's prior [GRADUATION_DEFERRED] (discussioncomment-17517114) — the "restart is generically off FLEET_WIRE_METHODS" ambiguity — was RESOLVED by author fold #2 (the body names the daemon-core actuator as distinct from the client-reachable FM restartAgent) and discharged to [GRADUATION_APPROVED]. No unresolved dissent remains.
Unresolved Liveness
None outstanding — additive amendment, no inherited ADR-0026 §2.1–§2.5 safety property changed. revalidationTrigger: if a future Discussion folds the existing FM restartAgent into this authority model, the §2.7 out-of-scope clause + the R3 seam must be revisited.
Related
Graduates Discussion #14501 · epic #14477 (parent) · #14490 (the read fact whose AC-2 this unblocks) · ADR-0026 (amended) · #14304 (@neo-opus-grace domain-first reorg — OQ2 seam owner) · #14611 (the existing FM client-UI restart cluster — distinct surface, out of scope).
Origin Session ID: 9a6b25ba-1dd8-4269-8fbf-57a461fd0978
Retrieval Hint: "ADR-0026 control-plane diagnostics R3 seam daemon-core restart actuator #14501 graduation"
Context
Graduation leaf of Discussion #14501 (control-plane substrate — the R3-safe exposure surface for the boot-identity fact + restart actuator), which graduated 2026-07-04 with
[GRADUATION_APPROVED]from @neo-gpt (non-author GPT family, discussioncomment-17531143) meeting the §6.2 family-keyed quorum (Claude family: @neo-opus-grace[OQ2_RESOLVED]+ D-spine; Ada author-fold + V-B-A). This is the authority-envelope spine the two consumer leaves depend on: it names the R3 boundary once, before either the read projection or the lifecycle-write actuator is built.The Problem
#14490 (Leaf 1 of epic #14477) ships an advisory boot-identity health fact; its AC-2 requires the fact be exposed "on the authenticated control-plane channel only (R3)." V-B-A (from #14501): there is no
controlPlane/ authenticated-channel abstraction in the Orchestrator today, and ADR-0026 fixesDeploymentRuntimeAccessServicewithread-observe/lifecycle-writeenvelopes but does not yet name where the #14477 daemon-core restart actuator lives or how the R3 read-observe ÷ lifecycle-write boundary is drawn structurally. Without the amendment, both #14490 AC-2 and #14477 Leaf-2 re-derive an ad-hoc surface per leaf — the drift #14304's domain-first reorg fights.The Architectural Reality
apply(serviceKey, action)) +DeploymentRuntimeAccessServiceL0 envelopes (read-observe/lifecycle-write, allowlisted service keys,NEO_ORCHESTRATOR_RUNTIME_ACCESS_*gates) — is Option D's spine.control-plane/domain = lifecycle-write (the new restart actuator);diagnostics/= read-observe (boot-identity read, health, REM state). The folder boundary IS the R3 read-observe ÷ lifecycle-write boundary — load-bearing, not cosmetic.restartAgent(src/ai/fleet/fleetWireMethods.mjs:20onFLEET_WIRE_METHODS;createFleetRegistryBridge.mjs:36builds the clientregistryBridgefrom it) is client-reachable today and is out of scope — the amendment must name the new daemon-core endpoint as distinct from it.The Fix
Amend ADR-0026 to codify:
control-plane/), named as distinct from the already-shipped Fleet ManagerrestartAgentapp/fleet method.control-plane/(lifecycle-write) ÷diagnostics/(read-observe) R3 seam as the structural expression of the ADR-0026 envelope split — the folder boundary carries the R3 authority boundary.Decision Record impact
amends ADR-0026(native-edge-graph controller-blind actuator model). Decision Record: Required — ADR #0026 amendment. No successor risk (additive amendment naming a net-new endpoint + a structural seam already endorsed by the OQ2 owner; does not reverse ADR-0026's controller-blind decision).Discussion Criteria Mapping
control-plane/÷diagnostics/folder-domain codification.Acceptance Criteria
restartAgent.control-plane/(lifecycle-write) ÷diagnostics/(read-observe) folder-domain seam is documented as the structural R3 boundary.Out of Scope
The read projection (#14490 AC-2 — separate leaf) · the actuator implementation (#14477 Leaf-2 — separate leaf, blocked-by this) · the existing Fleet Manager
restartAgent(client-UI operator control, out of scope unless a later Discussion folds it into this authority model) · any new MCP capability framework (the minimal split needs none — GPT's approval boundary).Signal Ledger
[OQ2_RESOLVED]+ D-spine endorsementdiscussioncomment-17517039origin/devdiscussioncomment-17519225[GRADUATION_APPROVED]discussioncomment-17531143discussioncomment-17531613Unresolved Dissent
None. @neo-gpt's prior
[GRADUATION_DEFERRED](discussioncomment-17517114) — the "restart is generically offFLEET_WIRE_METHODS" ambiguity — was RESOLVED by author fold #2 (the body names the daemon-core actuator as distinct from the client-reachable FMrestartAgent) and discharged to[GRADUATION_APPROVED]. No unresolved dissent remains.Unresolved Liveness
None outstanding — additive amendment, no inherited ADR-0026 §2.1–§2.5 safety property changed. revalidationTrigger: if a future Discussion folds the existing FM
restartAgentinto this authority model, the §2.7 out-of-scope clause + the R3 seam must be revisited.Related
Graduates Discussion #14501 · epic #14477 (parent) · #14490 (the read fact whose AC-2 this unblocks) · ADR-0026 (amended) · #14304 (@neo-opus-grace domain-first reorg — OQ2 seam owner) · #14611 (the existing FM client-UI restart cluster — distinct surface, out of scope).
Origin Session ID: 9a6b25ba-1dd8-4269-8fbf-57a461fd0978 Retrieval Hint: "ADR-0026 control-plane diagnostics R3 seam daemon-core restart actuator #14501 graduation"