2026-07-30 premise correction
The operator has superseded the original rollout premise. The local Agent OS is
effectively a one-user installation on one maintainer machine, not an enterprise
migration surface. The goal is therefore:
Switch this machine once to the canonical container Agent OS, prove the live
runtime, then delete the local/parity/compatibility substrate that the switch
made obsolete.
The One-Reality architecture and this epic remain valid. The earlier rollout
mechanics do not: per-seat coexistence, permanent stdio preservation, generalized
promotion/demotion, and a long-lived reverse-migration controller would preserve
the second reality this epic exists to remove.
This is an explicit operator correction to the older "per-seat opt-in only" and
"deleting stdio is out of scope" language below the original Discussion
graduation. Historical comments remain the decision trail; this body is the
current execution contract.
Problem scope
The local runtime and cloud runtime still have different owners, transports,
defaults, process supervisors, and data placement:
- local seats spawn stdio Memory Core and Knowledge Base processes;
- a host
legacy-mixed Orchestrator owns both unavoidable machine effects and
work that already belongs in the container plane;
- parity Compose profiles deliberately run beside the canonical local plane;
- deployment manifests restate many values that AiConfig should own as defaults;
- pilot, capture, promotion, demotion, and rollback tooling has become a
compatibility layer around a transition that only needs to happen once.
That divergence is now the defect. A successful migration does not leave a
parity platform behind.
Verified deletion census
Read-only census at dev@8849ca155d910bf608e8580c5ba8886280372be1 found:
| Boundary |
Existing production/config LOC |
| Strict whole-file one-way-cut candidates: six pilot/latency/WAL scripts plus parity-capture Compose/Caddy |
3,981 |
| Broader candidate set, including profiles that first need canonical replacements and recovery utilities that need a capability verdict |
~4,681 |
| Six specs paired directly with those diagnostic scripts |
2,353 test LOC |
The strict 3,981 is a candidate, not an automatic deletion mandate: 2,163 lines
are comparative-capture machinery, while 1,818 lines currently have no
production caller but may contain reusable recovery capability. Parity CI and
beside-native dev Compose can retire only after their canonical final-topology
replacement exists.
Additional parity-profile/CI coverage must be transformed with its canonical
replacement rather than counted wholesale. A production-only deletion of at
least 10,000 lines is therefore a target to falsify or prove with the final
ledger, not a verified floor. The census must separate whole-file deletion,
transformed replacement, retained capability, tests/docs, and avoided additions.
Separately, the first #16167 implementation spike added 3,470 lines
(2,751 production/docs, 686 new tests, and 33/-1 tracked support). It was stopped
before commit because most of it implemented permanent reversible-migration
machinery. Avoided additions are not counted as existing deletions.
Intended solution shape
- Make the container reality the default. #16039 moves policy and posture
into AiConfig. The normal profile defaults to cloud deployment,
container-plane authority, and no host-supervised local model servers.
Compose keeps only secrets, provider/tenant choices, privileged runtime
capabilities, and placement-specific networking.
- Perform one bounded cutover. #16167 uses the production Compose topology
plus the smallest machine bind/ingress override. The operator takes one
restorable backup/snapshot, stops local stdio writers and
legacy-mixed,
starts the canonical container plane on the existing canonical bytes, moves
resident MC/KB transports to HTTP, and proves authenticated MC/KB write-read
plus wake delivery.
- Keep only the unavoidable host edge. Wake delivery and any other
empirically proven machine-local effect run at the host edge. Prefer direct
daemons when that is the complete requirement, but retain the two-role
host-edge/container-plane authority guard while more than one host lane
remains.
legacy-mixed is retired; the full authority module is not presumed
obsolete by association.
- Delete the transition. After the live receipt is accepted, remove the
one-shot cutover procedure, parity/pilot/capture topology whose capability
audit says transition-only,
legacy-mixed, stdio opt-out compatibility,
redundant Compose overrides, and retired local wrappers/tests/docs.
- Retain reusable runtime substrate. Plane identity/coherence, canonical
MC/KB services, in-process WAL draining, generated remote adapters, Fleet
tenancy/readback, and genuinely container-used supervision stay unless a
separate falsifier proves them obsolete.
The completion metric is the live machine running the canonical topology with a
net-negative diff and no dormant compatibility path—not the existence of a
feature-rich migration controller.
Decision record impact
- ADR 0019: amend defaults and the policy-vs-deployment-choice boundary;
consumers continue to read AiConfig rather than re-deriving environment state.
- ADR 0014: amend the placement record if the remaining host-edge lanes
shrink or wake becomes a direct standalone process.
- Plane identity/placement decisions: retained. The canonical bytes move to a
new owner; parity data is never promoted into them.
Out of scope
- A general multi-machine installer or enterprise migration framework.
- Permanent per-seat opt-in/coexistence.
- Permanent rollback, scheduler-state merge, or stdio fallback after acceptance.
- Multi-tenant membership and fixtures from Discussion #15605; that work
consumes the completed canonical local runtime.
Avoided traps
- Compatibility as product: transition code survives the transition and
recreates two realities.
- Avoided-code arithmetic: the stopped 3,470-line spike is not counted as
deleted repository code.
- Deleting reusable runtime by association: remote adapters, plane
coherence, Fleet tenancy, and in-container WAL draining are not migration
scaffolding.
- Green health as cutover proof: live MC/KB write-read, served-plane identity,
resident HTTP consumption, exclusive ownership, and wake delivery are the
receipt.
- Path compatibility forever: normalize this machine's known external
.neo-ai-data symlink roots once; do not build general symlink-root support
into the steady state.
Provenance
Graduated from Discussion #15595 on 2026-07-24. The original family-keyed quorum
and author-family ratification remain the source of the One-Reality direction;
the 2026-07-30 operator ruling changes the rollout mechanics because the
single-user premise was previously modeled incorrectly.
Related: #16167 hard cut · #16039 default inversion · #16166 authority split to
retire/simplify · #15806 pilot diagnostics to delete after use · Discussion
#15605 downstream local multi-tenant application · One-Reality goal #15490.
Origin Session ID: 758f110e-a429-4597-beb0-5fd3ec7d1bfc
2026-07-30 premise correction
The operator has superseded the original rollout premise. The local Agent OS is effectively a one-user installation on one maintainer machine, not an enterprise migration surface. The goal is therefore:
The One-Reality architecture and this epic remain valid. The earlier rollout mechanics do not: per-seat coexistence, permanent stdio preservation, generalized promotion/demotion, and a long-lived reverse-migration controller would preserve the second reality this epic exists to remove.
This is an explicit operator correction to the older "per-seat opt-in only" and "deleting stdio is out of scope" language below the original Discussion graduation. Historical comments remain the decision trail; this body is the current execution contract.
Problem scope
The local runtime and cloud runtime still have different owners, transports, defaults, process supervisors, and data placement:
legacy-mixedOrchestrator owns both unavoidable machine effects and work that already belongs in the container plane;That divergence is now the defect. A successful migration does not leave a parity platform behind.
Verified deletion census
Read-only census at
dev@8849ca155d910bf608e8580c5ba8886280372be1found:The strict 3,981 is a candidate, not an automatic deletion mandate: 2,163 lines are comparative-capture machinery, while 1,818 lines currently have no production caller but may contain reusable recovery capability. Parity CI and beside-native dev Compose can retire only after their canonical final-topology replacement exists.
Additional parity-profile/CI coverage must be transformed with its canonical replacement rather than counted wholesale. A production-only deletion of at least 10,000 lines is therefore a target to falsify or prove with the final ledger, not a verified floor. The census must separate whole-file deletion, transformed replacement, retained capability, tests/docs, and avoided additions.
Separately, the first #16167 implementation spike added 3,470 lines (2,751 production/docs, 686 new tests, and 33/-1 tracked support). It was stopped before commit because most of it implemented permanent reversible-migration machinery. Avoided additions are not counted as existing deletions.
Intended solution shape
legacy-mixed, starts the canonical container plane on the existing canonical bytes, moves resident MC/KB transports to HTTP, and proves authenticated MC/KB write-read plus wake delivery.legacy-mixedis retired; the full authority module is not presumed obsolete by association.legacy-mixed, stdio opt-out compatibility, redundant Compose overrides, and retired local wrappers/tests/docs.The completion metric is the live machine running the canonical topology with a net-negative diff and no dormant compatibility path—not the existence of a feature-rich migration controller.
Decision record impact
Out of scope
Avoided traps
.neo-ai-datasymlink roots once; do not build general symlink-root support into the steady state.Provenance
Graduated from Discussion #15595 on 2026-07-24. The original family-keyed quorum and author-family ratification remain the source of the One-Reality direction; the 2026-07-30 operator ruling changes the rollout mechanics because the single-user premise was previously modeled incorrectly.
Related: #16167 hard cut · #16039 default inversion · #16166 authority split to retire/simplify · #15806 pilot diagnostics to delete after use · Discussion #15605 downstream local multi-tenant application · One-Reality goal #15490.
Origin Session ID:
758f110e-a429-4597-beb0-5fd3ec7d1bfc