Boot-identity AC-2: read-observe getBootIdentity projection on the authenticated registryBridge

Context

Graduation leaf of Discussion #14501 ([GRADUATION_APPROVED] @neo-gpt discussioncomment-17531143, §6.2 quorum met). Resolves the AC-2 blocker of #14490 (the advisory boot-identity health fact, Leaf 1 of epic #14477): AC-1 shipped the fact; AC-2 requires it be exposed on the R3-safe control-plane surface. #14501 resolved OQ1's presentation half: the read fact rides the existing authenticated client registryBridge as read-observe advisory state.

The Problem

#14490 AC-2 was blocked on "where does the authenticated exposure surface live?" #14501 resolved it: the boot-identity fact is advisory read-observe — AC-2 clause 2 explicitly permits the client Bridge/RPC to receive the read-only fact — so it may ride the already-authenticated client registryBridge as a read verb. What it must NOT do: carry, imply, or sit adjacent to any restart-affecting (lifecycle-write) command. That write authority is a separate leaf (#14477 Leaf-2) on a physically separate surface.

The Architectural Reality

• getBootIdentity returns the advisory {bootAt, sourceRef, schedulerResumeState, lastCycleRef} fact (shipped by #14490 AC-1).
• src/ai/fleet/createFleetRegistryBridge.mjs:36 builds the authenticated client registryBridge one method per FLEET_WIRE_METHODS entry — the existing authenticated presentation surface.
• Per the ADR-0026 amendment (#14758) diagnostics/ = read-observe: the boot-identity read is a read-observe projection, never a lifecycle-write.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR-0026 (+ the #14758 amendment codifying the read-observe ÷ lifecycle-write seam). Not blocked-by #14758 — the read-observe side is the un-contentious half (AC-2 clause 2 already permits it); it aligns with the amendment but does not gate on it.

Acceptance Criteria

• getBootIdentity exposed as a read-observe verb on the authenticated registryBridge; returns the advisory {bootAt, sourceRef, schedulerResumeState, lastCycleRef} fact.
• A test asserts the exposure carries NO restart-affecting / lifecycle-write command (R3 read-observe purity).
• #14490 AC-2 checkbox satisfied + annotated with this leaf.
• Cross-family review.

Out of Scope

The lifecycle-write restart actuator (#14477 Leaf-2, separate surface) · the ADR-0026 amendment itself (#14758) · the existing FM restartAgent client control.

Signal Ledger

Unresolved Dissent

None. @neo-gpt's prior [GRADUATION_DEFERRED] (discussioncomment-17517114) was RESOLVED by author fold #2 and discharged to [GRADUATION_APPROVED]. No unresolved dissent remains.

Unresolved Liveness

None outstanding — the read-observe exposure verb (additive, no lifecycle-write). revalidationTrigger: confirm getBootIdentity returns the live fact once the orchestrator wires a live BootIdentityHealthService into bootIdentitySource.

Discussion Criteria Mapping

Maps #14501's graduation criteria to this read-projection leaf:

• OQ1 (presentation boundary) → the read fact rides the authenticated registryBridge as read-observe advisory state; no lifecycle-write command.
• OQ3 (envelope separation) → this leaf is the read-observe half; the restart actuator (#14760) is the lifecycle-write half on a physically separate surface.
• §6.7 artifact (ADR amendment #14758 + #14490 AC-2 sub + #14477 Leaf-2 sub) → this issue is the #14490 AC-2 read-projection sub.

Related

Graduates Discussion #14501 · epic #14477 (parent) · #14490 (its AC-2 this resolves) · #14758 (the ADR-0026 amendment it aligns with) · ADR-0026.

Origin Session ID: 9a6b25ba-1dd8-4269-8fbf-57a461fd0978 Retrieval Hint: "boot-identity AC-2 read-observe getBootIdentity registryBridge projection #14501 graduation"