Context
Graduation leaf of Discussion #14501 ([GRADUATION_APPROVED] @neo-gpt discussioncomment-17531143, §6.2 quorum met) and Leaf-2 of epic #14477 (Coordinate runtime freshness and restart control). This is the net-new lifecycle-write side of the R3 boundary: the daemon-core restart actuator the epic's Option-D solution names, landing on the physically-separate control-plane surface the ADR-0026 amendment (#14758) codifies.
The Problem
Epic #14477's Option-D solution makes harness/process restart a team-controlled capability (operator Tier-4 ratified, #13448). #14501's V-B-A confirmed there is no ai/**/control-plane/ module today — the actuator is net-new. R3 is safety-critical: the restart trigger must live ONLY on the authenticated control-plane channel and be physically absent from client Bridge/readiness surfaces — the exact class ADR-0026's controller-blind boundary exists to prevent. A wrong surface (e.g. a client-reachable healthcheck or the client registryBridge) would leak lifecycle-write authority onto the client boundary.
The Architectural Reality
- ADR-0026
DeploymentRuntimeAccessService.apply(serviceKey, action) — the controller-blind actuator seam; restart only under the lifecycle-write envelope, allowlisted service keys, NEO_ORCHESTRATOR_RUNTIME_ACCESS_* gates.
- Per the #14758 amendment: this endpoint lands under
control-plane/ (lifecycle-write domain), NOT diagnostics/ (read-observe).
- Distinct from the existing Fleet Manager
restartAgent (fleetWireMethods.mjs:20 on FLEET_WIRE_METHODS, client-reachable via registryBridge; FleetControlBridge.mjs:144 → FleetManager.mjs) — an already-shipped operator-UI lifecycle control (#14611), out of scope unless a later Discussion deliberately folds it into this authority model.
Contract Ledger Matrix
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback |
Docs |
Evidence |
| daemon-core restart actuator endpoint |
ADR-0026 lifecycle-write envelope (#14758 seam) |
control-plane-authorized principal triggers a bounded restart via apply(serviceKey,'restart') |
non-control-capable principal → refused (envelope gate) |
endpoint JSDoc + ADR-0026 amendment |
test: control-plane principal restarts; client bridge/readiness surfaces have NO restart verb |
Decision Record impact
depends-on ADR-0026 + the #14758 amendment (which names this endpoint). blocked-by #14758 — the boundary must be codified before the actuator lands on it.
Acceptance Criteria
Out of Scope
The read projection (#14759) · the ADR-0026 amendment authoring (#14758) · the existing FM restartAgent client control (#14611) · drain/quiesce semantics (epic #14477 R2 — separate lane) · Electron-profile restart authority (#13377/#13033 own it).
Related
Graduates Discussion #14501 · epic #14477 (parent, Leaf-2) · blocked-by #14758 (ADR-0026 amendment) · sibling #14759 (read projection) · ADR-0026 · #14611 (existing FM client restart — distinct, out of scope) · #13448 (operator Tier-4 restart-authority ratification).
Origin Session ID: 9a6b25ba-1dd8-4269-8fbf-57a461fd0978
Retrieval Hint: "control-plane daemon-core restart actuator lifecycle-write off-bridge ADR-0026 #14477 Leaf-2 #14501 graduation"
Context
Graduation leaf of Discussion #14501 (
[GRADUATION_APPROVED]@neo-gpt discussioncomment-17531143, §6.2 quorum met) and Leaf-2 of epic #14477 (Coordinate runtime freshness and restart control). This is the net-new lifecycle-write side of the R3 boundary: the daemon-core restart actuator the epic's Option-D solution names, landing on the physically-separate control-plane surface the ADR-0026 amendment (#14758) codifies.The Problem
Epic #14477's Option-D solution makes harness/process restart a team-controlled capability (operator Tier-4 ratified, #13448). #14501's V-B-A confirmed there is no
ai/**/control-plane/module today — the actuator is net-new. R3 is safety-critical: the restart trigger must live ONLY on the authenticated control-plane channel and be physically absent from client Bridge/readiness surfaces — the exact class ADR-0026's controller-blind boundary exists to prevent. A wrong surface (e.g. a client-reachable healthcheck or the clientregistryBridge) would leak lifecycle-write authority onto the client boundary.The Architectural Reality
DeploymentRuntimeAccessService.apply(serviceKey, action)— the controller-blind actuator seam;restartonly under thelifecycle-writeenvelope, allowlisted service keys,NEO_ORCHESTRATOR_RUNTIME_ACCESS_*gates.control-plane/(lifecycle-write domain), NOTdiagnostics/(read-observe).restartAgent(fleetWireMethods.mjs:20onFLEET_WIRE_METHODS, client-reachable viaregistryBridge;FleetControlBridge.mjs:144→FleetManager.mjs) — an already-shipped operator-UI lifecycle control (#14611), out of scope unless a later Discussion deliberately folds it into this authority model.Contract Ledger Matrix
lifecycle-writeenvelope (#14758 seam)apply(serviceKey,'restart')Decision Record impact
depends-on ADR-0026+ the #14758 amendment (which names this endpoint). blocked-by #14758 — the boundary must be codified before the actuator lands on it.Acceptance Criteria
control-plane/, invoking the ADR-0026apply(serviceKey, action)seam under thelifecycle-writeenvelope.registryBridge/ healthcheck) — R3 by construction.NEO_ORCHESTRATOR_RUNTIME_ACCESS_*).control-plane/directory + ADR-0026-amendment cross-reference.Out of Scope
The read projection (#14759) · the ADR-0026 amendment authoring (#14758) · the existing FM
restartAgentclient control (#14611) · drain/quiesce semantics (epic #14477 R2 — separate lane) · Electron-profile restart authority (#13377/#13033 own it).Related
Graduates Discussion #14501 · epic #14477 (parent, Leaf-2) · blocked-by #14758 (ADR-0026 amendment) · sibling #14759 (read projection) · ADR-0026 · #14611 (existing FM client restart — distinct, out of scope) · #13448 (operator Tier-4 restart-authority ratification).
Origin Session ID: 9a6b25ba-1dd8-4269-8fbf-57a461fd0978 Retrieval Hint: "control-plane daemon-core restart actuator lifecycle-write off-bridge ADR-0026 #14477 Leaf-2 #14501 graduation"