Authority
GRADUATED: D#15605 body (fold 5, updatedAt 2026-08-01T16:05:54Z) §"Proposed partial graduation — the N=1 slice" — quorum complete per the consensus-mandate: [AUTHOR_SIGNAL] @neo-kimi-iris (kimi, Discussion author) + [GRADUATION_APPROVED] @neo-gpt-emmy (gpt, non-author family, replacing her deferral after both blockers closed). Operator mandate 2026-08-01, priority 1 of 3. Predecessor #16269 was closed as premature (filed pre-graduation); this leaf supersedes it with clean authority.
Context
Post-cutover, the containerized plane has NO ingestion feed: kb-config.yaml mounted on neither orchestrator nor kb-server, no configured tenantRepos, ingestion state never-attempted (audit receipts on #16167). Gap-0 restored the CORPUS (61,206 chunks @ 07-30); without this leaf ask_knowledge_base re-stales daily while the datasync pipeline's hourly artifacts (resources/content/, inside the repo) reach nobody. Deploy precondition satisfied: the Brain runs 36a63b7e.
The Build (zero-code PMV per the graduated slice)
kb-config.yaml registering neomjs/neo as pull-mode tenant (neo-shared tier), placed at the deployment home (<neoRootDir>/kb-config.yaml per the tiered resolver's read path) — tracked-example vs deploy-home-only is the first commit's one open placement decision (settle against the resolver + the overlay's relative-path conventions; the file holds no secrets).- Both compose mounts (orchestrator + kb-server, read-only) — the base compose comment documents the shape and names the silent-fallback trap this closes.
- First sanctioned sync → the identity-classified reconciliation receipt (graduated point 3, Emmy's spec): pre/post ID-set delta classified by chunk identity — tenant/repo + hash/type/name/source with parser fields in the hash; overlapping identities REUSE IDs; legitimate new/removed identities accounted by source-path + parser/hash identity; zero same-identity double representation. NOT an aggregate count.
- Recurring-sync checkpoint on a post-initial commit.
ask freshness proof: a cited known-hit on content that exists only post-07-30.
Contract Ledger
| Surface |
Contract |
| Document root |
tenants: map keyed by tenantId (bootstrap.tenants — listConfiguredTenantRepos's yaml tier); a flat root yields ZERO tenants silently |
| Entry fields |
tenantId + repoSlug (identity = tenantId/repoSlug) + cloneUrl (clean, no userinfo — assertCleanCloneUrl) + credentialRef (required; none = public clone) + branchRef (defaults HEAD; pinned dev here); optional mirrorRoot/cadenceMs ride defaults |
| Resolver / normalizer |
IngestionService.readKbConfigBootstrapResult({fileSystem}) (tier 2, injectable) → normalizeTenantRepoEntry / normalizeTenantRepoCredentialRef (tenantRepoAccessContract.mjs) — malformed entries THROW at normalization |
| Orchestrator consumer |
TenantRepoSyncService per-repo loop: GitMirror clone/fetch → ingest envelope → lastIngestedRev persistence; per-repo failure isolation; kbSync never re-pointed (separation invariant) |
| KB consumer |
IngestionService.getTenantConfig query-time resolution, same tier order (graph node → this file → aiConfig defaults) |
| Fail-soft vs fail-loud |
File READ is fail-soft (missing/malformed → null → lower tier, SILENT — hence the regression spec reading the tracked bytes through the production reader); entry NORMALIZATION is fail-loud (contract errors throw) |
| Guard |
test/playwright/unit/ai/deploy/KbTenantBootstrapContract.spec.mjs — production reader (status: loaded, tenantCount: 1) + production normalizer (exact neo-shared/neo entry) + both overlay mounts |
Acceptance Criteria
Out of Scope
Per the graduated slice: include-manifests / membership / multi-tenant admission (D#15605 epic, @neo-kimi-iris) · GP/native-graph freshness (separate source + receipt) · the deployment pipeline (D#15758's actuator authority) · #16224 (observed, not fixed here).
Related
- D#15605 (graduated authority) · #16167 (the acceptance path) · #16269 (closed premature predecessor) · #16224, #16174 (adjacent known defects) · D#15758 (actuator authority for any automation)
Origin Session ID: 1021960a-ad70-4ea9-ba96-c0f5b4bb553d
Retrieval Hint: neo tenant N=1 kb-config pull mode graduated identity classified reconciliation receipt ask freshness known-hit mounts
Authority
GRADUATED: D#15605 body (fold 5,
updatedAt 2026-08-01T16:05:54Z) §"Proposed partial graduation — the N=1 slice" — quorum complete per the consensus-mandate:[AUTHOR_SIGNAL]@neo-kimi-iris (kimi, Discussion author) +[GRADUATION_APPROVED]@neo-gpt-emmy (gpt, non-author family, replacing her deferral after both blockers closed). Operator mandate 2026-08-01, priority 1 of 3. Predecessor #16269 was closed as premature (filed pre-graduation); this leaf supersedes it with clean authority.Context
Post-cutover, the containerized plane has NO ingestion feed:
kb-config.yamlmounted on neither orchestrator nor kb-server, no configuredtenantRepos, ingestion statenever-attempted(audit receipts on #16167). Gap-0 restored the CORPUS (61,206 chunks @ 07-30); without this leafask_knowledge_basere-stales daily while the datasync pipeline's hourly artifacts (resources/content/, inside the repo) reach nobody. Deploy precondition satisfied: the Brain runs36a63b7e.The Build (zero-code PMV per the graduated slice)
kb-config.yamlregisteringneomjs/neoas pull-mode tenant (neo-shared tier), placed at the deployment home (<neoRootDir>/kb-config.yamlper the tiered resolver's read path) — tracked-example vs deploy-home-only is the first commit's one open placement decision (settle against the resolver + the overlay's relative-path conventions; the file holds no secrets).askfreshness proof: a cited known-hit on content that exists only post-07-30.Contract Ledger
tenants:map keyed by tenantId (bootstrap.tenants—listConfiguredTenantRepos's yaml tier); a flat root yields ZERO tenants silentlytenantId+repoSlug(identity =tenantId/repoSlug) +cloneUrl(clean, no userinfo —assertCleanCloneUrl) +credentialRef(required;none= public clone) +branchRef(defaultsHEAD; pinneddevhere); optionalmirrorRoot/cadenceMsride defaultsIngestionService.readKbConfigBootstrapResult({fileSystem})(tier 2, injectable) →normalizeTenantRepoEntry/normalizeTenantRepoCredentialRef(tenantRepoAccessContract.mjs) — malformed entries THROW at normalizationTenantRepoSyncServiceper-repo loop: GitMirror clone/fetch → ingest envelope →lastIngestedRevpersistence; per-repo failure isolation;kbSyncnever re-pointed (separation invariant)IngestionService.getTenantConfigquery-time resolution, same tier order (graph node → this file → aiConfig defaults)null→ lower tier, SILENT — hence the regression spec reading the tracked bytes through the production reader); entry NORMALIZATION is fail-loud (contract errors throw)test/playwright/unit/ai/deploy/KbTenantBootstrapContract.spec.mjs— production reader (status: loaded,tenantCount: 1) + production normalizer (exact neo-shared/neo entry) + both overlay mountsAcceptance Criteria
[L4-deferred — operator handoff needed: kb-server + orchestrator recreate adopts the mounts][L4-deferred — operator handoff needed][L4-deferred — operator handoff needed]ask_knowledge_basecited known-hit on post-07-30-only content.[L4-deferred — operator handoff needed][L4-deferred — operator handoff needed]Out of Scope
Per the graduated slice: include-manifests / membership / multi-tenant admission (D#15605 epic, @neo-kimi-iris) · GP/native-graph freshness (separate source + receipt) · the deployment pipeline (D#15758's actuator authority) · #16224 (observed, not fixed here).
Related
Origin Session ID: 1021960a-ad70-4ea9-ba96-c0f5b4bb553d
Retrieval Hint:
neo tenant N=1 kb-config pull mode graduated identity classified reconciliation receipt ask freshness known-hit mounts