Hard-cut this machine to the canonical Docker Agent OS, then delete legacy

Context

Native child of #15798; the live GitHub parent relationship is set.

The operator corrected this ticket's premise on 2026-07-30: this is a one-user machine cutover, not a reusable enterprise migration. The previous implementation shape—a reversible lifecycle controller with permanent parity and fallback layers—was stopped before commit.

Exact stopped-spike census at dev@8849ca155d910bf608e8580c5ba8886280372be1:

The adapter/core implemented image attestations, generalized PID and writer censuses, scheduler projection/merge, durable transition receipts, ordered reverse safe-stop, and rollback containment. Those are coherent for a migration product and wrong for a one-time switch on the only local installation.

Problem

This machine still depends on:

• host legacy-mixed Orchestrator ownership;
• per-resident stdio Memory Core and Knowledge Base writers;
• beside-native parity Compose and external .neo-ai-data symlink sharing;
• local-first AiConfig defaults that force the canonical deployment to restate its normal posture; and
• a host wake path that directly opens and mutates the graph through better-sqlite3.

Stopping the local Orchestrator today would remove important host effects, including wake delivery. Starting the container plane ad hoc would risk duplicate writers. The answer is one short, bounded ownership transfer followed by deletion—not a permanent coexistence controller.

The graph ownership defect is now isolated as #16180. It is a native child of this ticket, and this ticket is natively blocked by it. #16180 replaces the direct host graph tail with a signed same-machine Shape-B dispatcher. #14168 remains the broader remote/multi-machine delivery lane; its lease and migration scope is not imported into this one-machine cutover.

Target steady state

• Docker Compose owns Memory Core, Knowledge Base, Chroma, GraphLog subscription matching/digests, and the container Orchestrator.
• The host owns only irreducible machine effects: the signed wake/session final mile from #16180, Neural Link/browser/OS effects, and repository-workflow effects. Webpack remains a separate developer tool rather than an Agent OS authority lane. A host model-provider process is optional only when explicitly selected.
• No host process imports better-sqlite3, GraphService, Memory Core graph queries, or a graph database path.
• Managed residents consume Memory Core and Knowledge Base through authenticated HTTP ingress. Native MC/KB stdio is removed after the accepted cutover receipt.
• There is one topology to operate and debug. No beside-native parity plane, reverse-migration path, or unnamed compatibility consumer survives cleanup.

Fix: switch once, prove, delete

1. Prepare the steady state

1. Land #16039 so the normal AiConfig posture is deploymentMode=cloud, authorityProfile=container-plane, with host-supervised Ollama/LM Studio disabled by default.
2. Land #16180 and prove that the host wake final mile is graphless. Container Memory Core owns subscription evaluation, coalescing, signing, retry, and graph state; the host verifies, durably accepts/deduplicates, applies presence/no-clobber policy, and invokes an extracted local adapter.
3. Remove Compose values that merely repeat AiConfig defaults. Retain secrets, provider/model choices, tenant identity, privileged runtime capabilities, listener/network placement, and explicit host-edge paths.
4. Base this machine on production docker-compose.yml with only a tiny local bind/ingress override. Do not layer on the beside-native parity profile.
5. Repair ROADMAP.md so the v13.2 One Reality gate names the Docker-canonical topology and MC/KB HTTP-only steady state rather than promising stdio as a contributor fallback.

The tracked preparation PR remains deliberately small: the canonical Compose override, routed health support, persistence/bootstrap artifacts, and the reviewed one-shot procedure/checklist. #16180 is its prerequisite, not hidden inside that size envelope.

2. Execute one operator cutover

The operator runs the exact merged preparation revision:

1. verify Docker, a fresh restorable logical backup, and one filesystem snapshot;
2. quiesce resident stdio MC/KB writers and stop legacy-mixed;
3. normalize this machine's known external .neo-ai-data symlink roots into the canonical root once;
4. start the canonical container plane on the existing bytes;
5. switch resident MC/KB configs to authenticated HTTP through loopback ingress;
6. start only the empirically required graphless host-edge processes;
7. prove served plane identity, MC and KB write-read, exclusive owners, resident consumption, signed wake delivery, and reboot/restart persistence.

Rollback exists only inside that unreleased cutover window: stop the replacement, restore the snapshot, and restart the prior revision. Once the live receipt is accepted, migration is forward-only and the cleanup PRs delete the temporary procedure plus obsolete runtime surfaces.

3. Delete the old reality

In one or more narrow cleanup PRs immediately after the accepted live receipt, remove:

• pilot promotion/demotion, latency, WAL snapshot/replay/baseline, and parity-capture tooling where the capability census proves it transition-only;
• parity-capture artifacts, then parity-CI and beside-native dev Compose once canonical final-topology coverage exists;
• legacy-mixed and host-only compatibility branches, PID/state artifacts, and duplicated entrypoints for container-owned lanes;
• native MC/KB stdio support, transport opt-outs, and transition receipts;
• the direct-graph Shape-C wake worker superseded by #16180;
• the uncommitted reverse scheduler-state merge and generalized rollback design (never land it);
• redundant environment overrides and retired local supervisor/sync wrappers;
• tests and docs whose only subject was the removed migration reality; and
• the one-shot cutover procedure itself after its receipt is recorded.

Orchestrator authority census

#16173 classifies 29 lanes. Classification is an ownership map, not automatic deletion authority:

The live host census narrows two large candidates:

For all 18 container-owned lanes, the cleanup ledger must classify:

1. retained container execution code;
2. deleted legacy-mixed / host-only compatibility branches;
3. deleted host-only wrappers, state, PID artifacts, or duplicated entrypoints;
4. moved/re-added code, reported separately and excluded from net shrinkage.

MCP transport disposition

shared is transport infrastructure, not a seventh MCP server.

Therefore the final claim is no native MC/KB stdio fallback, not “no stdio anywhere.”

Deletion accounting

The strict whole-file pilot/parity set already proves 3,981 existing production/config LOC plus 2,353 paired test LOC. The cross-surface whole-file census raises the current existing-production/config floor to 4,935 LOC; the larger host-lane numbers above remain candidates until shared dependencies and moves are separated.

The target remains at least 10,000 existing production LOC deleted. The final ledger must either prove that target or explicitly falsify it with an irreducible keep ledger. It must:

• count existing production LOC deleted;
• exclude avoided additions;
• exclude moves and re-additions from net shrinkage; and
• report tests, config, docs, and generated artifacts separately.

Do not delete by association:

• canonical plane identity/coherence and placement checks;
• long-running HTTP Memory Core and Knowledge Base services;
• in-process WAL drain cycles/locks used by Docker MC;
• generated remote adapters and Fleet tenancy/readback;
• genuinely container-used process supervision;
• canonical backup/restore; or
• unavoidable host wake/Neural-Link/repository effects and the two-role authority guard while named host-edge lanes remain.

Acceptance criteria

• The normal AiConfig posture is the container/cloud reality; Compose no longer restates matching defaults.
• #16180 lands first and statically proves that the host wake process has no graph, SQLite, GraphService/query, or database-path dependency.
• One restorable backup and snapshot are recorded before owner mutation.
• This machine runs production Compose plus a minimal local bind/ingress override on the existing canonical data.
• No resident stdio MC/KB writer or legacy-mixed owner remains.
• A resident consumes authenticated HTTP MC/KB; served plane identity and MC/KB write-read pass.
• Signed wake delivery and reboot/restart persistence pass with only the irreducible host-edge processes.
• The six-server transport matrix above is reflected in runtime config and docs; shared BaseServer is not counted as a server.
• Every one of the 18 container-owned lanes is attributed as retained container code, deleted host compatibility, deleted wrapper/artifact, or excluded move.
• ROADMAP.md no longer promises native MC/KB stdio fallback.
• The one-shot transition/rollback procedure is removed after the accepted receipt.
• The final ledger reports existing production deletion excluding avoided additions and moves/re-additions; tests, config, and docs are separate; ≥10,000 production LOC is proved or explicitly falsified by an irreducible keep ledger.
• The complete cutover-plus-cleanup series is net-negative and contains no permanent parity, coexistence, reverse-migration, remote-graph, or native MC/KB-stdio fallback layer.

Decision record impact

• ADR 0002 is amended by #16180 for turn-priced Shape-B coalescing and the bounded retry/mailbox-authoritative restart contract.
• ADR 0014 is amended for the container authority and reduced graphless host edge.
• ADR 0019 is amended for cloud/container defaults and the policy-vs-secret/deployment-choice boundary.

Out of scope

• General multi-machine installation packaging.
• Generic remote/NAT delivery, exclusive-seat migration, or lease management (#14168).
• Multi-tenant membership, identity, fixtures, or admission from Discussion #15605.
• Preserving local behavior solely for hypothetical external local-Agent-OS users.
• Fleet diagnostics UI; shape that from the accepted live topology.

Related

Parent #15798 · graphless host prerequisite #16180 · broader remote wake #14168 · defaults #16039 · authority compatibility #16166 · plane placement #15800 · generated adapters #15805 / PR #16053 · pilot tooling #15806 / PR #16037 · downstream Discussion #15605.

Origin Session ID: 71ff2f5e-17d6-47b2-90db-82bc1773b0a0

MCP client default hard-cut ledger (2026-08-07)

This is a bounded closure/cleanup contract after the accepted cutover. It does not replay the migration or reclassify host-local MCP families.

Prior-art continuity: Memory Core raw memory 98371060-9a06-41bf-9ab9-da49e9b29b2e. Intake classification: valid-as-written for this bounded cleanup clause; the migration itself is not replayed.