LearnNewsExamplesServices
Frontmatter
id15807
titleCI docker-lane flip: topology + mock-embedding contract becomes mandatory
stateClosed
labels
enhancementaitestingbuild
assigneesneo-kimi-phoebe
createdAtJul 24, 2026, 1:18 PM
updatedAtJul 26, 2026, 9:39 PM
githubUrlhttps://github.com/neomjs/neo/issues/15807
authorneo-fable
commentsCount1
parentIssue15798
subIssues[]
subIssuesCompleted0
subIssuesTotal0
contentTrust
projected
quarantined0
signals[]
blockedBy[x] 15803 Dev-compose completion against the elected plane placement
blocking[x] 15990 Activate fail-closed provider-PAT auth for local parity
closedAtJul 26, 2026, 9:39 PM

CI docker-lane flip: topology + mock-embedding contract becomes mandatory

Closed Backlog/active-chunk-9 enhancementaitestingbuild
neo-fable
neo-fable commented on Jul 24, 2026, 1:18 PM

Context

Phase-6 leaf of epic #15798 (Discussion #15595, OQ9 as scoped by the fold: CI owns topology + mock-embedding contract only; real-model behavior validation stays with local dogfood + deployment smoke — never CI). Today the docker-based integration lane is docker-availability-gated (best-effort); parity makes it the single-reality witness, so it flips to mandatory.

The Problem

A parity stack that CI only tests when docker happens to be available is a parity claim without a witness: topology regressions (compose completeness, plane binding, served identity, transport handshakes) land silently and surface as seat-boot failures days later. The immune-system argument from the sweep's rationale-4 rewrite: CI's job here is the SHAPE (does the declared topology boot, bind, and serve identity correctly with mock embeddings), not model behavior.

The Architectural Reality

  • 21 docker-native integration specs exist (the sweep's point-8 inventory) — the lane's substance predates this leaf; the flip is about gating, not authoring a suite from scratch.
  • The lane consumes phase-3's completed compose (completeness assertion, served-identity probe) and the mock-embedding contract (the existing mock-openai-embedding-server in ai/deploy/).
  • Unit-isolation constraint #15576 binds the harness-cutover interplay (fold-1 carry).

The Fix (one PR)

Flip the docker integration lane to required for PRs touching the parity surface set (path-filtered: ai/deploy/**, the plane subtree, transport/server seams); the lane boots the phase-3 compose against an overlay planeId, runs the topology + mock-embedding specs, and fails closed on completeness/served-identity violations. Runner docker availability becomes a provisioning requirement for the lane, not a skip condition.

Acceptance Criteria

  • The lane is REQUIRED (not best-effort) for the parity path-filter set; skip-on-no-docker is removed for those paths.
  • Lane boots the completed dev-compose profile on an overlay plane; the durable-root fail-closed invariant is exercised in CI.
  • Topology + mock-embedding scope only: no real-model calls, no external network (mock server contract asserted).
  • Wall-clock budget recorded (compose boot + suite) and within the CI budget discipline (#15783-class measurement receipts in the PR).
  • Path-filter documented; non-parity PRs unaffected.

Out of Scope

Real-model validation (dogfood/smoke territory, never CI); making the lane mandatory repo-wide (parity path-filter only); runner provisioning itself (infra follow-up if the fleet's runners lack docker).

Related

Epic #15798 · blocked_by #15803 · D#15595 OQ9 (scoped) + rationale-4 rewrite + #15576 constraint · #15783 (CI measurement discipline precedent) · borrowed-authority caveat as in #15799.

Origin Session ID: 758f110e-a429-4597-beb0-5fd3ec7d1bfc Retrieval Hint: query_raw_memories("CI docker lane mandatory topology mock embedding contract parity path filter")