What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	15526
title	FM door: launch motion composition + Brain external-consumer pricing (the download-activation gate)
state	Open
labels	enhancementai
assignees	neo-gpt-emmy
createdAt	Jul 18, 2026, 9:30 PM
updatedAt	Jul 25, 2026, 1:02 AM
githubUrl	https://github.com/neomjs/neo/issues/15526
author	neo-fable-clio
commentsCount	5
parentIssue	15519
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
contentTrust
projected
quarantined	0
signals	[]
blockedBy	[ ] 15523 FM door: the minimum site — three pages, the recorded take as hero, notify-me; born in the storefront
blocking	[]

FM door: launch motion composition + Brain external-consumer pricing (the download-activation gate)

Open Backlog/active-chunk-7 enhancementai

neo-fable-clio commented on Jul 18, 2026, 9:30 PM

Context

Sub of epic #15519 (graduated D#15498). The launch motion — the encounters that make the door matter — composed with #14790's playbook, plus the Brain-side pricing the STEP_BACK bound.

The Work

Compose the launch moments (every moment cites the site — the one-URL invariant); the engine repo is the embedded proof one click deeper, never a competing target. Before the download button activates (row 3), price the Brain/MCP external-consumer class: authz + rate implications of outsiders running the cockpit against surfaces today priced operator-only. The launch sequence itself stays #14790's authority; this sub delivers the door's slice and the pricing gate. When #15490 row 3 walks and the pricing gate is complete, this same sub performs the mechanical activation: the previously absent download action appears once, points at the release-receipt-backed artifact, and resolves through the one canonical site URL.

The word pricing here means the operational authority, rate, and resource cost of adding an external consumer class. It does not introduce commercial subscription tiers.

Scope Boundary

This ticket records the external-consumer envelope, composes the door's launch slice into #14790, and later owns the bounded absent→exactly-one site activation.
A public/shared hosted Brain is not a v13.2 prerequisite. The public door is zero-Brain; the downloaded product operates the local or BYO-tenant boundary.
The remote snapshot projection described below is a new, separate implementation child. It is not shipped substrate and is not smuggled into this launch/activation ticket.
Remote mutation is a different authority class. It remains absent from the v13.2 external DTO vocabulary.

Contract Ledger

Target Surface	Source of Authority	Proposed Behavior	Fallback / Edge Case	Docs	Evidence
#14790 launch-playbook FM slice (new composition)	#14790 phase ordering; #15519 one-URL invariant; ADR 0037 §2.2	Every outward moment cites the one canonical product site. The engine repository is an inspectable proof link inside that site, never a competing launch target.	Until #15520/#15523 bind the name and URL, use a symbolic slot only; do not publish an alternate URL or outward CTA.	Fold the phase 0–4 FM slice into #14790 and keep the storefront launch notes aligned.	Body/comment diff on #14790 plus an outbound-link scan proving one canonical target per moment.
Anonymous public site / watch-the-fleet (new site mode)	#15524/#15550 receipts; ADR 0037 §§2.3, 2.5	Serve the recorded take and honestly labelled bundled sample with zero Brain/provider calls on default first paint.	If recorded/sample truth is unavailable, render an honest unavailable state; never fall through to raw MCP tools, operator Brain surfaces, or a reduced provider feed presented as live truth.	Site copy and provenance caption.	Browser network witness proving zero Brain/provider calls plus DOM assertions for the sample/provenance label.
Downloaded Fleet Manager → local fleet (existing contract consumed, not widened)	`src/ai/fleet/installFleetBridge.mjs`; `ai/services/fleet/devFleetServer.mjs`; ADR 0037 §2.3	Consume the existing local Fleet bridge under its loopback/process credential and server-owned viewer boundary. The operator owns the machine and fleet; no hosted-service metering claim is introduced.	Connection or credential failure remains visible and fail-closed; it never widens the bridge into an anonymous/public endpoint.	Local first-run/runbook copy and site product boundary.	Existing bridge unit/integration tests plus the #15490 row-3 first-self-use walkthrough receipt.
Token-present public-fleet projection (new future projection)	#15550 capability/rate receipt; ADR 0037 §2.5; current `ai/services/github-workflow/communityActivityShadowReader.mjs` is probe-only and `notAuthority`	If implemented, reuse provider acquisition behind one shared cached Brain projection; cockpit reads never trigger one provider acquisition per viewer poll.	Quota/capability failure stays visible. Cache miss serves a labelled last-good snapshot or honest unavailable and schedules refresh asynchronously; it never fabricates an empty fleet or silently degrades to a different acquisition contract.	Future child ticket Contract Ledger plus service JSDoc/API docs.	Provider-call-count concurrency witness, stale/unavailable tests, and a proof that default first paint remains zero-call.
Remote tenant read projection (new future projection)	#15526 operational-envelope decision and Phoebe's G1/G2 falsifier; `ai/services/fleet/FleetTenantService.mjs` currently proves admission/credential custody only	A positive tenant-scoped DTO allowlist may expose authenticated-tenant public agent summaries plus bounded status, capability, and age. Ownership is shared per tenant; cache identity includes tenant plus registration/credential generation; an old in-flight result cannot overwrite a newer generation.	First empty read is honest unavailable plus scheduled refresh. Only a prior last-good snapshot may be served stale. A miss never performs viewer-triggered synchronous upstream work.	Separate implementation child's endpoint/OpenAPI/JSDoc contract.	Positive-field and positive-absence tests on success and error paths, multi-viewer singleflight proof, and reconnect/credential-rotation generation-fence tests.
Remote mutation vocabulary (explicitly absent)	#15526 authority decision 4; current mixed local `FLEET_WIRE_METHODS` is not an external-consumer contract	Start/stop/restart, configuration, mailbox access/compose, raw MCP tools, operator-wide topology, and foreign-tenant data cannot be represented by the v13.2 external DTO.	Unsupported authority is rejected; no blocklist-shaped “all reads except…” fallback. Any later mutation transport requires its own explicit capabilities, falsifiers, and authority decision.	External-consumer boundary docs and future child ledger.	Negative schema/dispatch tests proving the forbidden values and verbs are unrepresentable.
Pre-activation site DOM (new site state)	#15490 row 3; #15798 is the named first-self-use vehicle; ADR 0037 §2.3; #15523	Before row 3 has a dated first-self-use receipt, this pricing ledger is complete, and a release receipt exists, all site pages and responsive breakpoints contain zero download actions. Honest primary actions are watch and notify.	The action is absent—not disabled, “coming soon,” or linked to a placeholder. A failed or stale gate reverts to zero actions.	Site CTA copy and activation checklist.	Pre-activation DOM assertions across all three pages/breakpoints plus a semantic-link check that watch/provenance/repo links cannot masquerade as download.
Post-activation site DOM (new site state)	ADR 0037 §2.3; `buildScripts/release/publish.mjs` release authority; #15490 row-3 receipt	Add exactly one working download action at the canonical site. It resolves to the receipt-backed artifact; the storefront consumes the monorepo receipt and never mints version or release authority.	Missing, contradictory, or unresolved receipt means zero download actions. No direct release-asset URL may leak into outward channel copy as a second launch target.	Storefront `release/RECEIPTS.md`, site CTA copy, and #14790 measurement fold.	E2E canonical site → one download action → receipt-backed artifact; negative link scan; download-select/download-resolve event receipt.

Acceptance Criteria

The launch-moment plan names the site as sole target per moment; composed into #14790.
The Brain external-consumer pricing is recorded (what an outside cockpit may reach, at what rate, with what auth) BEFORE download activation.
The download-activation checklist exists: row 3 walked + pricing done + button ships.
Before both gates clear, the site DOM contains no download action; after they clear, exactly one working download action is present and resolves to the release-receipt-backed artifact.

Epic #15519 · #14790 · D#15498 (STEP_BACK consumer sweep) · #15490 row 3 · ADR 0037 · #15524 · #15550 · #15798.