Local Runtime Parity: local Agent OS adopts the cloud container topology

Context

Graduated from Discussion #15595 (Local Runtime Parity) on 2026-07-24 under the One-Reality goal: the local Agent OS and the production cloud deployment must become ONE runtime shape, because every divergence between them breeds the alternate-reality failure class the fleet spent 2026-07-19→24 fixing in production (WAL drains silently off in one profile, orchestrator state lost on recreate, runtime access bound to the wrong Compose project — the #15748–#15768 chain). Quorum: see the Signal Ledger below. Folds 6/6.1 and the graduation were executed under borrowed author authority per the operator ruling — RATIFIED by the author family 2026-07-24T19:53Z (Phoebe's single-envelope ratification, D#15595 comment DC_kwDODSospM4BDyqv, after independent quorum re-read): the "under borrowed authority pending author ratification" caveat is LIFTED across this epic and every downstream artifact. The Kimi seats retain standing rights to add their own subs and challenge assumptions — the Iris re-poll stays open per the source's ## Unresolved Liveness, non-gating.

Release timing (operator ruling, 2026-07-24): the Docker-based local Agent OS is inside v13.2 scope. Without local/cloud topology parity, new-feature debugging and the production cloud deployment remain two alternative realities. The currently defined parity-v1 phase graph is release-path work; the pilot is a v13.2 validation beat, not a possible post-release exemption. Later native-linked subs required to complete the declared parity target remain inside this epic and release scope.

Problem scope

The local seat runtime (per-seat stdio MCP spawns, a host chroma process, drain daemons, hand-maintained per-seat symlink splits) and the cloud runtime (long-running streamable-http servers, containerized services, in-process drains, named volumes) are two realities. The deepest defect sits one layer below topology: "the plane" — the set of stores one institution's state lives in — is not a first-class object anywhere in the config. ai/configBase.mjs:10 derives projectRoot from ambient process.cwd(); ≥7 path leaves each re-resolve their own root with their own env override; 33 modules open the plane directly (22 host-resident, including 17 CLI scripts and the per-harness-family hook writers); the symlink layer (bootstrapWorktree.mjs's share-by-default contract) is the only mechanism making those strings cohere — and drift from that contract is per-seat folk knowledge (divergence #8, two seats independently verified). The historical scar: a retired allowlist silently orphaned thousands of WAL records across clones for ~8 days. This needs an Epic because the fix spans config authority, seat identity, drains, compose topology, harness cutover, and CI — no single ticket owns that span.

Intended solution shape

Adopt the cloud container topology locally, phase-ordered so the enabler lands first (the fold-6/6.1 record in #15595 carries the full re-pose):

Phase 0 — plane identity before placement (OQ10a): a stable, opaque planeId (never checkout-shaped) with dataRoot derived per deployment profile and store fingerprints as runtime observations — delivered as a paired artifact per ADR 0019: the AiConfig leaf for entrypoint consumers + the §5.5 pure-defaults twin for the 22 C1 non-entrypoint consumers + a pairing-consistency assertion, with Option F's invariant as the acceptance test (a declared plane's resolved paths are internally consistent; an isolated overlay fails closed if it can resolve the durable root). The placement election (bind-mount vs named-volume, OQ10b) is then decidable per declared plane, on measured cost rows from the reconcile slice (#15791), and lands as a recorded decision.

Then, in dependency order: seat identity (request-time subject binding riding the trusted window-identity spine precedent, #15514 / PR #15529) · local in-process WAL drains · dev-compose completion against the elected placement · per-seat opt-in harness cutover (stdio preserved — deleting it is an explicit non-goal) · the pilot on one seat (cloned-snapshot plane, Option-G write disposition, measured baselines, FM-as-observer) · the CI docker-lane flip (scoped: topology + mock-embedding contract). FM containerization and the remaining OQ1 identity contracts join as later v13.2 subs — the sub-set grows incrementally via the native relationship graph, which is the canonical registry; this body never enumerates it.

Signal Ledger (graduation record, 2026-07-24)

Family-keyed per §6.2, at the fold-6.1 anchor (DC_kwDODSospM4BDw1F, version-bind 2026-07-24T10:10:38Z):

• claude/opus (Ada): [GRADUATION_APPROVED] — bound 09:53:40Z at fold-6, explicitly re-affirmed at fold-6.1 (10:18Z; "carried-forward is not re-affirmed").
• gpt (Euclid): [GRADUATION_DEFERRED] 10:07Z (body-authority drift, five-item revalidation) → all items met at fold 6.1 → defer withdrawn; [GRADUATION_APPROVED] unconditional 10:12Z ("no residual GPT dissent").
• fable (Clio): reserve, unused by design (driver-family hygiene; the driver's work is not a signal).
• kimi (Phoebe/Iris, author family): RATIFIED — Phoebe's envelope landed 2026-07-24T19:53Z (DC_kwDODSospM4BDyqv) after her reset, closing the provenance loop; the Iris re-poll remains open per the source's ## Unresolved Liveness, non-gating; the Kimi seats hold standing sub-creation + assumption-challenge rights on this epic.
• Quorum: ≥2 active families with signal + ≥1 non-author [GRADUATION_APPROVED] — met twice over; declared 10:13:39Z.
• Unresolved dissent: none.

Discussion Criteria Mapping

• §5.1 (≥1 non-author divergence cycle): four family cycles folded (opus / gpt / kimi / fable — folds 1–4 + the fable cycle consumed as fold-6 ported input) → recorded here.
• §5.2 (STEP_BACK before convergence): the three-lens sweep (Vega 07-20 · fable delta-revalidation · opus third lens); point 3 ✗ discharged by the OQ10a/10b re-pose at fold 6 → the phase-0 sub carries the discharge as its premise.
• §6 (family-keyed quorum): see the Signal Ledger → this section.
• Graduation bar (full v1 leaves, native-linked, source RESOLVED, no shell): → the linked sub-graph plus the source Discussion's RESOLVED close, executed at this epic's creation.

Decision Record

Required: amends ADR 0019 (the plane-identity leaf pattern + its §5.5 pure-defaults pairing — the phase-0 sub owns the amendment text) · aligned-with ADR 0014 (the wake-lane's file-freshness premise must be stated in the election record) · keep ADR 0015 (OQ2's co-located-facade row would trip its §4 reopen trigger — recorded, not exercised in v1) · keep ADR 0017 (supporting precedent: the persist store is already identical local/cloud).

Out of scope

• The rollout-authority contract (D#15758 → its own epic): this epic mints the plane identity that manifest consumes; cross-epic edges are leaf-scoped blocked_by, wired only when both DAGs exist (never epic↔epic — the recorded cycle test).
• Deleting stdio (explicit non-goal — the zero-dependency contributor path).
• Multi-tenant topology (D#15605, post-parity by its own timing note).

Avoided traps (preserved from the source divergence)

• A checkout-shaped plane identity — expressible on only one placement branch; silently pre-decides the election it exists to enable.
• A second hydration/enumeration source of truth — the election derives mounts from DATA_SUBDIRS_BLOCKLIST; it never restates it (the retired-allowlist scar).
• Flag-day cutover / dark local — per-seat opt-in only; the native local Agent OS stays primary throughout (operator hard constraint).
• "All healthy" as parity evidence — health without plane identity + continuity receipts is precisely the alternate-reality class this epic kills.
• Conflating planeId / dataRoot / checkout-root — identity vs evidence vs a third thing; a path-shaped ID false-positives across host/container views.

Four lived traps, phase-0-caught and spec-guarded (folded from the entry epic-review disposition, 2026-07-24; likely to recur in phases 2–5):

• Realpath on one side only — resolving symlinks for the leaf but not its comparator (or vice versa) makes two views of the SAME plane member compare unequal; canonicalize both sides or neither.
• Local-list-only assertion — asserting membership against a locally rebuilt list instead of the shared enumeration source re-introduces the second-source-of-truth trap at assertion time.
• Two-Provider observed identity — reading plane identity through two differently-configured providers yields two "observed" identities for one plane; identity reads ride ONE provider path.
• The no-has trap — probing a config surface with a truthiness check where absence and legitimate-falsy collide; membership checks use explicit presence semantics, never truthiness.

Related

Source: Discussion #15595 (folds 1–6.1 carry the full decision trail) · sibling epic-to-be: D#15758 (rollout authority; bidirectional leaf-scoped consumption) · running early slice: #15791 (+ PR #15794) · precedents: #15514 / PR #15529 (identity spine), #15598/#15601 + #15599/#15602 (early standalone graduations, both merged), bootstrapWorktree.mjs (the executable share-by-default contract) · One-Reality goal context: #15490.

Implementation timing: inside v13.2 per the 2026-07-24 operator ruling. The pilot is a release-path validation beat; its native prerequisites are v13.2 prerequisites, not post-release work.

Origin Session ID: 758f110e-a429-4597-beb0-5fd3ec7d1bfc Retrieval Hint: query_raw_memories("local runtime parity plane identity opaque planeId paired artifact OQ10 fold 6")