[ ] 16167 Dogfood the canonical Docker Agent OS on a maintainer machine, [ ] 16039 Deployment config defaults absorb the env-override surface: policy becomes AiConfig, env keeps only secrets and choices
closedAt
Jul 30, 2026, 3:08 PM
Split host-edge and container orchestrator task authority
Native sub of #15798. The parity stack now has a container orchestrator, but the maintainer machine still runs npm run ai:orchestrator from the host checkout as the effective Agent OS supervisor. The intended end state is one machine with two explicit authorities:
a host edge for capabilities that intrinsically touch the local desktop/session, such as wake delivery; and
the container plane for cloud-capable Agent OS services and maintenance work.
This is not a request to turn off local capabilities. It is the contract that makes stopping the legacy mixed-responsibility host supervisor safe.
Problem
Live audit at dev@65092deb422cec749e5817937a351b106cb27d79 on 2026-07-30 found the resident host orchestrator running from the canonical maintainer checkout. Its persisted state lists 24 owned entries. It currently supervises Chroma, the bridge/wake daemon, dev server, Neural Link bridge, embed/message daemons, summary, Memory Summary backfill, KB sync, GitHub Workflow sync, backup, graph-log compaction, primary-dev sync, dream, message-concept harvest, Golden Path, two liveness watchdogs, and other scheduled work.
At the same time, ai/deploy/docker-compose.dev.yml defines a container orchestrator with NEO_AI_DEPLOYMENT_MODE=cloud. Docker was not running during the audit, so that topology owned none of this machine's work. Stopping the host process today would immediately stop its Chroma child and wake daemon, and would remove the only observed owner for multiple cloud-capable lanes.
The current binary orchestrator.deploymentMode = local | cloud is too coarse for the desired topology. local enables both machine-local edges and plane work; cloud disables local-only edges. Setting the host to either value cannot express “wake locally, maintain the plane in Docker.”
Architectural reality
ai/configBase.mjs owns deployment selection and the orchestrator.localOnly / cloudOnly descriptors under ADR 0019.
ai/daemons/orchestrator/Orchestrator.mjs owns continuous child supervision and scheduled task dispatch.
ai/daemons/orchestrator/taskDefinitions.mjs and the task registry own scheduled task definitions, but continuous children are not represented by that same classification surface.
ADR 0014 keeps wake delivery local because it must address local harness sessions. That does not make Chroma, summary, dream, graph compaction, or watchdogs host-local.
#11720 established the earlier cloud-deployable / local-only / shared primitive classification direction; #11503 and #11519 established cross-daemon heavy-maintenance single-owner leases. This leaf consumes those precedents instead of inventing another scheduler.
ADR 0019 forbids leaf consumers from re-reading env, duplicating legal-mode predicates, or mutating runtime config. Role/authority must be resolved once through AiConfig and consumed at the task start boundary.
Fix — one coherent PR
Introduce an explicit orchestrator authority profile that can represent the host-edge role separately from the container-plane role. Classify every continuous child and scheduled task at its canonical definition, then derive start eligibility from that classification through AiConfig.
The host-edge profile starts only capabilities whose effects require the host/session boundary. The container-plane profile owns every cloud-capable Agent OS service or maintenance lane. Shared primitives have one declared owner per profile; they are not started opportunistically by both.
Add a startup/preflight receipt that reports the resolved owner of every task and rejects an incomplete or double-owned required lane before either supervisor begins work. Preserve the existing heavy-maintenance lease as runtime collision defense; do not mistake it for an authority model.
Contract Ledger
Surface
Source of authority
Required behavior
Failure mode / fallback
Evidence
Orchestrator role/profile
AiConfig.orchestrator + ADR 0019
Resolve host-edge vs container-plane once at entry
Unknown role fails boot; no hidden local fallback
Config unit matrix
Continuous children
Orchestrator.mjs canonical child registry
Every child declares one authority class
Unclassified child fails the ownership audit
Exhaustive registry test
Scheduled tasks
task definitions / registry
Every task declares one authority class
Missing or contradictory class fails boot
Exhaustive task matrix
Wake delivery
ADR 0014 local delivery edge
Host edge remains capable of delivering local wakes
Container must never claim desktop wake effects
Negative container test + host positive test
Plane work
parity/cloud topology
Cloud-capable services and maintenance run in Docker
ADR 0019 amendment required. Record the authority-profile leaf and profile matrix; keep the reactive Provider as the only runtime source of truth.
ADR 0014 aligned. Wake remains host-local; this ticket makes that exception explicit instead of using it to justify a mixed supervisor.
Acceptance Criteria
A canonical classification covers every continuous orchestrator child and every scheduled task; an unclassified addition fails a focused test.
A host-edge profile starts wake/session-local effects but does not start Chroma, MC/KB plane drains, summary, dream, graph compaction, concept harvest, plane watchdogs, or other cloud-capable maintenance.
A container-plane profile starts the cloud-capable set and never attempts local desktop wake delivery, local worktree mutation, or host-only UI/process effects.
The combined host-edge + container-plane matrix has exactly one owner for every required lane; duplicates and gaps fail before work starts.
The resolved ownership receipt is machine-readable and lists role, task, authority class, and effective owner without secrets.
Existing heavy-maintenance lease behavior and local-only/cloud-only tests remain green.
ADR 0019 records the profile/leaf contract and explicitly forbids per-consumer env or mode re-derivation.
Out of scope
Starting Docker or cutting over this machine (downstream dogfood leaf).
Removing stdio support.
Containerizing Fleet Manager.
Changing deployment defaults merely to shrink Compose env (owned by #16039 after this authority is explicit).
Replacing the task scheduler or heavy-maintenance lease.
Avoided traps
local renamed to edge: keeps the mixed ownership while changing vocabulary.
Set the host to cloud: disables the very local wake edge the host must retain.
Mutex as routing: prevents simultaneous heavy work but cannot prove the right supervisor owns it.
Two classification tables: continuous children and scheduled tasks must consume one authority vocabulary, not drift independently.
Per-task env flags: recreates the env-override surface #16039 exists to remove.
Related
Parent #15798 · prior classification #11720 · wake authority ADR 0014 · AiConfig authority ADR 0019 · single-owner leases #11503/#11519 · downstream machine dogfood leaf to be linked after creation · config-default consolidation #16039.
Live duplicate sweep: latest 20 open issues by creation time + recent 30 A2A messages + GitHub title/body searches + Knowledge Base ticket search, 2026-07-30T11:25Z. No open ticket owns this host-edge/container-plane authority split; #11720 is closed prior art, #14477 owns runtime freshness/restart authority, and #16039 owns config-default consolidation.
tobiu referenced in commit 4c1762e - "feat(ai): split orchestrator task authority (#16166) (#16173)" on Jul 30, 2026, 3:08 PM
Context
Native sub of #15798. The parity stack now has a container orchestrator, but the maintainer machine still runs
npm run ai:orchestratorfrom the host checkout as the effective Agent OS supervisor. The intended end state is one machine with two explicit authorities:This is not a request to turn off local capabilities. It is the contract that makes stopping the legacy mixed-responsibility host supervisor safe.
Problem
Live audit at
dev@65092deb422cec749e5817937a351b106cb27d79on 2026-07-30 found the resident host orchestrator running from the canonical maintainer checkout. Its persisted state lists 24 owned entries. It currently supervises Chroma, the bridge/wake daemon, dev server, Neural Link bridge, embed/message daemons, summary, Memory Summary backfill, KB sync, GitHub Workflow sync, backup, graph-log compaction, primary-dev sync, dream, message-concept harvest, Golden Path, two liveness watchdogs, and other scheduled work.At the same time,
ai/deploy/docker-compose.dev.ymldefines a container orchestrator withNEO_AI_DEPLOYMENT_MODE=cloud. Docker was not running during the audit, so that topology owned none of this machine's work. Stopping the host process today would immediately stop its Chroma child and wake daemon, and would remove the only observed owner for multiple cloud-capable lanes.The current binary
orchestrator.deploymentMode = local | cloudis too coarse for the desired topology.localenables both machine-local edges and plane work;clouddisables local-only edges. Setting the host to either value cannot express “wake locally, maintain the plane in Docker.”Architectural reality
ai/configBase.mjsowns deployment selection and theorchestrator.localOnly/cloudOnlydescriptors under ADR 0019.ai/daemons/orchestrator/Orchestrator.mjsowns continuous child supervision and scheduled task dispatch.ai/daemons/orchestrator/taskDefinitions.mjsand the task registry own scheduled task definitions, but continuous children are not represented by that same classification surface.cloud-deployable/local-only/shared primitiveclassification direction; #11503 and #11519 established cross-daemon heavy-maintenance single-owner leases. This leaf consumes those precedents instead of inventing another scheduler.Fix — one coherent PR
Introduce an explicit orchestrator authority profile that can represent the host-edge role separately from the container-plane role. Classify every continuous child and scheduled task at its canonical definition, then derive start eligibility from that classification through AiConfig.
The host-edge profile starts only capabilities whose effects require the host/session boundary. The container-plane profile owns every cloud-capable Agent OS service or maintenance lane. Shared primitives have one declared owner per profile; they are not started opportunistically by both.
Add a startup/preflight receipt that reports the resolved owner of every task and rejects an incomplete or double-owned required lane before either supervisor begins work. Preserve the existing heavy-maintenance lease as runtime collision defense; do not mistake it for an authority model.
Contract Ledger
AiConfig.orchestrator+ ADR 0019localfallbackOrchestrator.mjscanonical child registryDecision Record impact
ADR 0019 amendment required. Record the authority-profile leaf and profile matrix; keep the reactive Provider as the only runtime source of truth.
ADR 0014 aligned. Wake remains host-local; this ticket makes that exception explicit instead of using it to justify a mixed supervisor.
Acceptance Criteria
Out of scope
Avoided traps
localrenamed toedge: keeps the mixed ownership while changing vocabulary.cloud: disables the very local wake edge the host must retain.Related
Parent #15798 · prior classification #11720 · wake authority ADR 0014 · AiConfig authority ADR 0019 · single-owner leases #11503/#11519 · downstream machine dogfood leaf to be linked after creation · config-default consolidation #16039.
Origin Session ID:
71ff2f5e-17d6-47b2-90db-82bc1773b0a0Retrieval hints: Memory
fcb8cae5-b0ef-47ae-a6bc-4b83feb556ce(deployment env/default census); Memory7f031561-b514-4d9a-a69d-88b45e87b4a5(host orchestrator supervises bridge/wake).Live duplicate sweep: latest 20 open issues by creation time + recent 30 A2A messages + GitHub title/body searches + Knowledge Base ticket search, 2026-07-30T11:25Z. No open ticket owns this host-edge/container-plane authority split; #11720 is closed prior art, #14477 owns runtime freshness/restart authority, and #16039 owns config-default consolidation.