Plane identity: opaque planeId as a paired AiConfig leaf + pure-defaults twin

Context

Phase-0 leaf of epic #15798 (Local Runtime Parity), graduated from Discussion #15595. The §5.2 sweep's confirmed blocker (point 3, path determinism): the data-root election cannot be decided because "the plane" is not a declared object — it is ≥7 path strings agreeing on a prefix, held together only by the symlink layer. This leaf mints the missing subject. Everything else in the epic sequences behind it (Ada's enabler inversion: this leaf makes the pilot-posture and port-band ACs expressible and the wake-latency envelope priceable).

The Problem

• ai/configBase.mjs:10: const projectRoot = process.cwd() === '/' ? neoRootDir : process.cwd(); — the root is ambient, per-process.
• ≥7 plane-member leaves each re-resolve their own root with their own env escape (NEO_MEMORY_DB_PATH, NEO_MEMORY_WAL_DIR, NEO_MESSAGE_WAL_DIR, daemon dirs, log path; e.g. ai/mcp/server/memory-core/configBase.mjs:346 resolves path.resolve(cwd, '.neo-ai-data/memory-wal')).
• 33 modules open the plane directly; 22 are C1 non-entrypoints (17 host CLI scripts + per-harness-family hook writers + host daemons) that per ADR 0019 C1 (zero tolerance) must NOT import AiConfig.
• NEO_AI_CANONICAL_ROOT exists but is provisioning-only (read solely by ai/scripts/migrations/bootstrapWorktree.mjs) — and it names a checkout, which is identity on only one placement branch.

The Architectural Reality

ADR 0019 governs (read gate: §critical_gates 10 — mandatory full read before authoring or reviewing; its §3 catalog bans exactly the current shape: A1 re-derivation, hidden defaults). §5.5 defines the sanctioned non-entrypoint shape: a pure-defaults module (literals + env-var names, no Neo import) — ai/mcp/server/memory-core/helpers/TurnPresenceConfig.mjs is the in-tree precedent ("without importing Neo singletons"). The assertion precedent for pairing/boot checks: bootstrapWorktree.mjs:189-196 (module-load invariant throw).

The Fix (one PR)

1. The leaf (entrypoint side): a declared plane-identity subtree in ai/configBase.mjs — a stable opaque planeId (never a path, never checkout-shaped — the corrected refinement: a checkout-shaped identity pre-decides the OQ10b election) + per-deployment-profile dataRoot derivation from which the ≥7 plane-member leaves derive. Env binding via leaf(default, env, type) only.
2. The twin (non-entrypoint side): a pure-defaults module carrying the same defaults + env names (no Neo import), consumed by the 22 C1 sites (migration of those call sites is follow-up work per site owner; this leaf ships the twin + migrates the memory-core helper as the exemplar).
3. The pairing-consistency assertion: a unit test + module-load check asserting the twin's literals match the leaf's declarations — the twin must never drift into a second source of truth.
4. The F-invariant boot assertion: at server boot, a declared plane's resolved paths are internally consistent; an isolated overlay fails closed if it can resolve the durable root.
5. The ADR 0019 amendment text documenting the plane-identity leaf pattern + the pairing discipline (this leaf owns the amendment; Decision Record: amends ADR 0019).

Contract Ledger

Acceptance Criteria

• planeId is opaque (no path content); dataRoot derives per deployment profile; the three concepts (identity / resolved evidence / checkout root) are never conflated in the API. (Landed: opacity enforced on RESOLVED values — one predicate behind the load guard, resolver, leaf env-parse, and the boot assertion; three-concept separation in the twin JSDoc + ADR §10.3.)
• All ≥7 plane-member leaves derive from the declared subtree (no independent ambient-cwd re-derivation remains in them). (Landed: 20 members across 4 config bases on one anchor; two deliberate profile-pinned/homedir exceptions flagged in the PR — neither is ambient-cwd.)
• The twin exists, no Neo import, with a pairing-consistency test that fails on drift. (Landed constructively: the leaf declares FROM the twin, so literal drift is impossible; the test pins resolver semantics.)
• Boot assertion: internally-consistent resolved paths; overlay-sees-durable-root fails closed (test for both branches). (Landed: assertPlaneCoherence at the BaseServer.runHealthcheckAndLogStatus head — every boot order; symlink-transparent realpath check, spec'd with a real symlink fixture.)
• ADR 0019 amendment included; ADR 0014's wake-lane file-freshness premise referenced in the amendment. (Landed: §10 + §5.5 cross-ref; ADR 0014 binding in §10.4.)
• Diff passes ADR 0019 §3 by construction (no A1/A4/A5/B1/B3/B4/B5/C1 instances). (Verified: reviewer patch-blind §3 sweep item-by-item + both CI lints, 0 new violations; the mc module-scope inline env read RETIRED — an A1-class removal.)
• Reconcile report (#15791) consumed as the ground-truth reference in tests where seat variance matters. (Landed: the seat-variance witness block pins every migrated member default to the single anchor, cwd-independent — the probe's divergence class cannot re-enter through defaults.)

Out of Scope

• The placement election itself (the OQ10b leaf, blocked by this one).
• Migrating all 22 non-entrypoint call sites (exemplar migration only; the rest follow per-site).
• Any mount/volume/compose change.

Related

Epic #15798 · source Discussion #15595 (folds 6/6.1) · ground truth #15791 / PR #15794 · ADR 0019 · bootstrapWorktree.mjs · borrowed-authority note: discharge "under borrowed authority pending author ratification" until the source's ratification window closes.

Implementation: PR #15811 (5 commits, 086cb28e08 → 5a6e3afcc3). Consumer requirements folded pre-implementation from the Lane-2 owner's comment: observed-identity emission (mc + kb healthcheck payloads) + the provisioning disposition (declared by the deployment layer; never persisted in-plane; never path-derived).

Origin Session ID: 758f110e-a429-4597-beb0-5fd3ec7d1bfc Retrieval Hint: query_raw_memories("opaque planeId paired artifact pure-defaults twin ADR-0019 C1")