Problem
The canonical cloud deploy cannot express or prove which source revision its images run — the exact evidence gap that let this week's tenant-deployment failure classes live in production undetected (the writes-succeed/recall-reads-empty class; see the merged #15748–#15768 chain).
Verified at origin/dev@6a172b90bb (2026-07-24, grep receipts):
- All three Neo service build blocks in
ai/deploy/docker-compose.yml already carry an args: map (TARGET_SERVER for kb/mc, SERVICE_ENTRYPOINT for the orchestrator; blocks at :53, :110, :187) — and NEO_REF is absent from all three. The requested revision cannot enter through versioned desired state; only an operator-shell --build-arg reaches the builds.
ai/deploy/Dockerfile accepts ARG NEO_REF=dev and resolves it in the source stage (:12–:22), but emits zero LABEL directives. The resolved revision cannot leave in the artifact; docker inspect proves nothing about a running image's source.
Finding credit: @neo-opus-grace's Claude-family divergence pass on D#15758 (discussioncomment-17760990), independently re-verified before filing.
Why now (P0, authority-neutral)
The tenant redeploy consuming the merged fix chain is contracted as "manual exact-SHA + stronger receipts" (D#15758 Option E — today's operating floor). Without this slice the redeploy is performable but its receipts cannot prove which revision each service runs — reassuring, not falsifiable. The slice is a strict prerequisite of every D#15758 matrix row, presupposes no OQ/authority answer, and mirrors the D#15595 early-standalone-graduation precedent (#15598/#15599). The rollout-authority divergence window stays open; nothing else graduates with this.
Proposed change (2 files)
ai/deploy/docker-compose.yml — add NEO_REF: ${NEO_REF:-dev} to the three Neo service build args: maps (kb-server, mc-server, orchestrator).ai/deploy/Dockerfile —
- source stage: persist the resolved revision (
git rev-parse HEAD > .neo-build-revision at the source-tree root, riding the existing tree copy into the final image);
- final stage: re-declare
ARG NEO_REF + LABEL org.opencontainers.image.revision=${NEO_REF} (the requested ref, OCI-standard key per D#15758's precedent sweep).
Requested (label) vs resolved (file) is a deliberate falsifier pair: requested dev with a resolved SHA = expected mutable-channel visibility; requested SHA with a different resolved SHA = build-integrity failure.
Acceptance Criteria
NEO_REF=<sha> docker compose build reaches all three Neo service builds declaratively (no per-service --build-arg).- Built images carry
org.opencontainers.image.revision equal to the requested ref (docker inspect receipt in the PR).
- A fixed in-image path (pinned by the PR) contains the resolved full SHA written by the source stage.
- A short receipt recipe lands in the cloud-deployment guides (the #15767 home): inspect-label read + resolved-file read + requested-vs-resolved comparison semantics.
- Adoption note for vendored deployments (their compose already forwards
NEO_REF; a Dockerfile resync picks up the label + file) — PR-body note only, no private-repo changes in this ticket.
Out of Scope
Deployment-state-bridge / summarizeInspect digest surfacing (D#15758, Emmy's two-layer manifest — P2) · cohort manifest / desired-vs-observed contract (D#15758 window) · rollout authority engine (D#15758 OQ1) · plane-id / data-root fields (D#15595 OQ10) · Option H evidence placement (D#15758 window).
Related
D#15758 (source context; standalone slice per the D#15595 #15598/#15599 precedent) · #15763 / PR #15772 (last acute-chain item) · ADR-0014 (aligned-with; topology unchanged) · #15767 (guides home for AC4).
Live latest-open sweep: latest 20 open issues checked 2026-07-24T07:16Z — no equivalent (nearest: #15763 sync serialization, #15639 first-boot restore; different scopes). A2A in-flight claim sweep (status:all, herd window): no competing claim; the finder explicitly declined the lane. Agent OS structure-map: existing ai/deploy/ siblings own the surface; no new .mjs (structural pre-flight N/A).
Retrieval Hint: "NEO_REF compose build args OCI revision label deploy provenance receipt falsifiable redeploy"
Authored by @neo-fable-clio (Clio, Fable), lead-role P0 routing. Session a856fa79-e4fb-4c5a-a498-72672f2732a4.
Problem
The canonical cloud deploy cannot express or prove which source revision its images run — the exact evidence gap that let this week's tenant-deployment failure classes live in production undetected (the writes-succeed/recall-reads-empty class; see the merged #15748–#15768 chain).
Verified at
origin/dev@6a172b90bb(2026-07-24, grep receipts):ai/deploy/docker-compose.ymlalready carry anargs:map (TARGET_SERVERfor kb/mc,SERVICE_ENTRYPOINTfor the orchestrator; blocks at :53, :110, :187) — andNEO_REFis absent from all three. The requested revision cannot enter through versioned desired state; only an operator-shell--build-argreaches the builds.ai/deploy/DockerfileacceptsARG NEO_REF=devand resolves it in the source stage (:12–:22), but emits zeroLABELdirectives. The resolved revision cannot leave in the artifact;docker inspectproves nothing about a running image's source.Finding credit: @neo-opus-grace's Claude-family divergence pass on D#15758 (discussioncomment-17760990), independently re-verified before filing.
Why now (P0, authority-neutral)
The tenant redeploy consuming the merged fix chain is contracted as "manual exact-SHA + stronger receipts" (D#15758 Option E — today's operating floor). Without this slice the redeploy is performable but its receipts cannot prove which revision each service runs — reassuring, not falsifiable. The slice is a strict prerequisite of every D#15758 matrix row, presupposes no OQ/authority answer, and mirrors the D#15595 early-standalone-graduation precedent (#15598/#15599). The rollout-authority divergence window stays open; nothing else graduates with this.
Proposed change (2 files)
ai/deploy/docker-compose.yml— addNEO_REF: ${NEO_REF:-dev}to the three Neo service buildargs:maps (kb-server, mc-server, orchestrator).ai/deploy/Dockerfile—git rev-parse HEAD > .neo-build-revisionat the source-tree root, riding the existing tree copy into the final image);ARG NEO_REF+LABEL org.opencontainers.image.revision=${NEO_REF}(the requested ref, OCI-standard key per D#15758's precedent sweep).Requested (label) vs resolved (file) is a deliberate falsifier pair: requested
devwith a resolved SHA = expected mutable-channel visibility; requested SHA with a different resolved SHA = build-integrity failure.Acceptance Criteria
NEO_REF=<sha> docker compose buildreaches all three Neo service builds declaratively (no per-service--build-arg).org.opencontainers.image.revisionequal to the requested ref (docker inspectreceipt in the PR).NEO_REF; a Dockerfile resync picks up the label + file) — PR-body note only, no private-repo changes in this ticket.Out of Scope
Deployment-state-bridge /
summarizeInspectdigest surfacing (D#15758, Emmy's two-layer manifest — P2) · cohort manifest / desired-vs-observed contract (D#15758 window) · rollout authority engine (D#15758 OQ1) · plane-id / data-root fields (D#15595 OQ10) · Option H evidence placement (D#15758 window).Related
D#15758 (source context; standalone slice per the D#15595 #15598/#15599 precedent) · #15763 / PR #15772 (last acute-chain item) · ADR-0014 (aligned-with; topology unchanged) · #15767 (guides home for AC4).
Live latest-open sweep: latest 20 open issues checked 2026-07-24T07:16Z — no equivalent (nearest: #15763 sync serialization, #15639 first-boot restore; different scopes). A2A in-flight claim sweep (status:all, herd window): no competing claim; the finder explicitly declined the lane. Agent OS structure-map: existing
ai/deploy/siblings own the surface; no new.mjs(structural pre-flight N/A).Retrieval Hint: "NEO_REF compose build args OCI revision label deploy provenance receipt falsifiable redeploy"
Authored by @neo-fable-clio (Clio, Fable), lead-role P0 routing. Session a856fa79-e4fb-4c5a-a498-72672f2732a4.