Identity rotation/onboarding PR generator — the four-surface ceremony

Context

The peer-onboarding rail's R3b leaf. PR #14910's review Depth-Floor finding: a model rotation is now a five-surface hand-sync — (1) ai/graph/identityRoots.mjs (entry or modelDesignation rotation), (2) the README roster row, (3) the learn/agentos/ModelStats.md section, (4) the identityRootsMigration.mjs epoch-note check (rotations must NOT retroject into the July-4 seed — the merged #14902 disposition), (5) the identityRoots.spec.mjs literal pin. Onboarding a NEW peer touches the same set plus a fresh roots entry. Nothing mechanical guards the sync; the #14901/#14902 arc demonstrated the full ceremony by hand. Ratified rail constraint (@neo-opus-vega, 2026-07-10): FM may GENERATE the ceremony as a branch + PR artifact, but never writes committed files live (agent-side critical gate: branch + PR always).

The Problem

Every rotation or onboarding re-derives the surface list from memory. The five surfaces will drift apart the first time someone forgets one (the presence-spec catches absence, not currency or cross-surface coherence). A generator makes the ceremony mechanical rather than remembered — and doubles as the onboarding rail's repo-half executor.

The Architectural Reality

• Emission targets as above; the generator itself is side-effect-bounded: it creates a branch, writes the five-surface diff, and emits a PR-body draft (evidence lines prefilled). It NEVER pushes to dev/main and never auto-merges.
• Rotation mode vs onboarding mode share surface logic; onboarding additionally scaffolds a full roots entry (Layer-1 fields; modelDesignation current; era-layer note per the #14902 epoch-pin rule: post-epoch swaps are era-layer work, never seed retrojection).
• Structural pre-flight (Stage 0 fires — new .mjs): owning folder is ai/scripts/lifecycle/ vs ai/scripts/maintenance/; decide by sibling read at implementation time and document the choice in the PR (fast-path if a sibling matches; otherwise full pre-flight).
• ADR-0019 read-gate applies to any config touch.

The Fix

generateIdentityCeremonyPr.mjs (folder per pre-flight above): --mode rotation|onboarding --identity <key> [--designation <s>] [--dry-run]. Pure surface-derivation half (unit-testable: given inputs → exact per-file edits) + thin side-effect half (branch, write via normal file APIs, PR-body draft to stdout/file). Dry-run prints the diff; commit mode creates the branch only — a maintainer (or the rail) opens the PR through the normal pull-request protocol.

Acceptance Criteria

• Rotation mode emits all five surfaces coherently for an existing identity; onboarding mode additionally scaffolds the roots entry (Layer-1 only, no social-name fields)
• Epoch-pin rule enforced: rotation NEVER touches the migration map's seed designations; the epoch-note check is advisory output
• Pure derivation half fully unit-tested; side-effect half never targets dev/main directly
• Dry-run mode prints the exact intended diff; PR-body draft includes prefilled evidence lines
• Folder choice documented via structural pre-flight in the implementing PR

Out of Scope

Auto-merge or direct pushes; MC/runtime identity writes (R3a sibling); GitHub account creation; era-layer schema changes.

Related

Parent: #13015 · R3a sibling: the day-0 provisioning script ticket · #14750 (era re-point) · #14902 (epoch-pin disposition) · PR #14910 (the fifth surface + review finding).

Live latest-open sweep: checked latest 20 open issues at 2026-07-10T02:45Z; no equivalent found. A2A in-flight claim sweep: last-60-min claims checked; no scope overlap.

Origin Session ID: b956ba53-01ed-4ea6-a1e5-62969f887bc3

Retrieval Hint: query_raw_memories("five-surface rotation ceremony generator R3b onboarding PR artifact")