Build the BigData Neural Link probe and erase diagnostics

Context

Epic #15184 needs a reproducible local BigData Neural Link journey before the separately scheduled bilateral Genesis execution can happen safely. The approved source contract lives in D#15173.

This leaf owns the reusable Neo implementation: the isolated runner, exact local profile, blind-oracle machinery, cleanup proof, guide, focused tests, and a successful bundled live rehearsal. The required two-party execution receipt is the distinct native Epic successor #15291. It is required for D#15173 and Epic #15184, but it is not part of this implementation leaf's close contract.

Live duplicate sweep at creation checked the latest 20 open issues, broader GitHub search, recent A2A claims, Knowledge Base tickets, and synced issue/discussion content; no equivalent implementation ticket existed.

The Problem

A transport handshake alone does not provide a repeatable or privacy-safe proof journey. Neo needs a committed runner that establishes three mechanical boundaries before any external execution:

1. the standard Streamable HTTP client can use the exact three-operation local profile;
2. the BigData result can be compared against a precommitted structural oracle without teaching the answer;
3. every raw diagnostic sink stays inside one disposable root that can be erased only after verified shutdown.

Current code can write raw Neural Link args/results into SQLite nl_action_log, rotating nl-server-* files, and detached Bridge stdout/stderr into neural-link-bridge-stdio.log. Deleting guessed filenames is therefore insufficient; the runner must own and prove removal of the whole unique root.

The Architectural Reality

• RecorderService writes tool telemetry to the configured Memory Core SQLite path and uses WAL sidecars.
• Neural Link logging and Bridge stdio can create multiple files under the configured log root.
• The approved profile exposes only healthcheck, get_worker_topology, and lean get_component_tree at depth 2.
• The public BigData app supplies a deterministic root/direct-child structure, and exactly one intended App Worker session is required.
• Listener and bearer authority come from #15185; exact projection authority comes from #15186. This leaf consumes those contracts rather than rebuilding them.

The Fix

Add one reference runner that creates a unique temporary root, places SQLite and every Neural Link log inside it, starts the loopback-only dev server, Bridge, and MCP server, and connects through the standard MCP SDK.

Each child must prove ownership through its private post-bind log marker before TCP reachability can advance. The runner generates or consumes one disposable canonical bearer, exposes only the exact profile, canonicalizes the expected structure as fixed-order whitespace-free JSON, and implements the approved salted commitment/reveal formula.

On every success, failure, abort, or signal path, close clients and browser state, terminate each child tree with positive absence verification, capture a recursive before-manifest, and remove the whole root. Cleanup owns a bounded safety clock independent of the active-session deadline. The bundled rehearsal must prove the oracle, listener closure, process-group termination, root absence, and untouched default paths.

Contract Ledger

Decision Record impact

aligned-with ADR 0019 and ADR 0020; no ADR amendment.

Decision Record

NOT_NEEDED — consumes existing local transport, projection, diagnostic, and entrypoint-config authorities.

Acceptance Criteria

• Native prerequisites #15185 and #15186 are complete and consumed without reconstructing their auth or projection contracts.
• The runner fails before probing unless exactly one intended BigData App Worker session is available.
• The reference client connects through standard Streamable HTTP, a literal-loopback URL, disposable bearer, and server-pinned local-readonly-probe profile.
• Every child proves its exact host-and-port bind through a child-private post-bind marker before TCP reachability or bearer use; an unrelated loopback listener cannot advance startup.
• Asynchronous child-launch failures stay inside the runner's catch/finally cleanup path, including pid-less failed launches after earlier children started.
• The runner implements fixed-order canonical JSON, a secret 32-byte lowercase-hex salt, newline separator, SHA-256 commitment, and reveal machinery exactly as D#15173 specifies.
• One unique temporary root owns the SQLite database and every Neural Link log/stdio sink; startup aborts if any configured raw-diagnostic path escapes it.
• The recursive before-manifest records relative path, type, and byte size for every artifact, including database/WAL/SHM, rotating server logs, Bridge/MCP/dev stdio, and unexpected files.
• Cleanup closes clients/browser state, positively verifies leader and POSIX process-group absence, removes the whole root, proves listener closure, and proves default live database/log paths stayed untouched.
• Cleanup owns a bounded safety clock independent of the active-session deadline; transient signal-send errors still require positive absence verification.
• Only aggregate tool/status/duration counts and the revealed rehearsal oracle survive; bearer, headers, raw args/results, raw logs, and unrevealed oracle material do not.
• Focused unit/security tests and one bundled live BigData rehearsal pass on the exact PR head.
• One PR fully delivers this implementation, guide, tests, and bundled receipt; it Resolves #15187 and only relates to Epic #15184.
• Required Epic successor #15291 remains open for the separately scheduled bilateral external receipt and is not relabeled optional.
• Changed classes and methods satisfy Contextual Completeness JSDoc and @summary requirements.

Out of Scope

• Executing or claiming the bilateral external Genesis receipt; required successor #15291 owns that outcome under Epic #15184.
• Implementing external-client transport changes inside Neo.
• Cloud/container deployment, public endpoints, PAT/OAuth/OIDC, or tenant identity.
• Mutations, reciprocal access, logs/store/source/method disclosure, or a wider tool profile.
• Retaining raw telemetry after review.

Related

Parent Epic: #15184
Required successor: #15291
BLOCKED_BY #15185
BLOCKED_BY #15186
Source: D#15173
Refs #13056

Origin Session ID: 5b19219a-d8ad-4505-864f-19b5eab44a45

Retrieval Hint: #15184 BigData probe runner child readiness oracle cleanup manifest #15291