Nothing can say whether a cohort is admissible to a target

Refs #16448

Context

Sub of #16448, from D#16304's criterion 4 resolution (@neo-opus-ada): the two audiences are explicitly split, and the recorded reason is the configuration-overlay surface — with the owner named as the thing to fix. This ticket is that thing.

The Problem

Nothing in the tree can answer "may this target take this cohort?" — so selection has no predicate to consult, and the split the graduation recorded cannot be enforced.

Measured on dev:

• Four daemons fail closed on config-overlay drift, naming --migrate-config and exiting: embed/daemon.mjs:51, message/daemon.mjs:32, wake/daemon.mjs:2884, orchestrator/daemon.mjs:63. Activation alone can produce a plane whose daemons refuse to boot.
• No admissibility surface exists. compatibilityContract, supportMatrix, minimumSupportedRevision, externallyAdmissible return zero hits across ai/, src/, buildScripts/. Row I of the divergence matrix proposes one, which confirms none exists rather than merely suggesting it.

So "arbitrary dev cohorts are not externally admissible" is true and currently unrepresentable — the system cannot state it, let alone check it.

The Architectural Reality

• ai/scripts/lint/config-leaf-parity.json already classifies requiredDeploymentInputs, forbiddenEnv and secrets. The contract's raw material exists and is machine-readable; what is missing is a predicate over it, expressed per cohort.
• ai/scripts/setup/migrateConfigOverlay.mjs migrates the config.mjs overlay and states explicitly it is "never env-resolved values" — so the env half is uncovered.
• #16447 is this ticket's superseded predecessor, not its written-prose complement. (Corrected 2026-08-04 — @neo-gpt and @neo-opus-ada both measured that this line still routed live authority to a closed ticket. It also misdescribed it.) #16447 began as "make MigrationPath.md truthful" and was re-scoped by operator direction to be the executable delta itself — the same shape as this ticket — then closed NOT_PLANNED. Its re-scope note is the reason this ticket is code and not prose: a hand-written guide "serves an audience of zero and documents a manual runbook instead of removing it." Nothing about a written guide is pending; this ticket carries the contract that neither of #16447's two forms delivered.

The Fix

Declare what makes a cohort admissible for a given target, derived from the existing census rather than hand-written: which required inputs it introduces, which keys it retires, and which overlay migrations it demands. Selection consults the predicate; a cohort that would land a plane in fail-closed boot is not admissible for that target.

Contract Ledger Matrix

Decision Record impact

none — derives a predicate from an existing machine-readable census.

Acceptance Criteria

• A predicate answers "may target T take cohort C?" and names the blocking required inputs / retired keys when the answer is no.
• It is derived from config-leaf-parity.json and each leaf's requiredFor metadata, not hand-maintained — a hand-list stales exactly as MigrationPath.md did. That staleness is the precedent, and it is what #16447 originally existed to repair before it was re-scoped and closed.
• Unknown resolves to not admissible. Absence of evidence must never read as admissibility.
• The four fail-closed daemon guards are covered: a cohort introducing a required leaf is inadmissible to a target that lacks it.
• Selection (sibling sub) can consult the predicate; a refusal carries its reason into the ineligibility record.
• Nothing here widens or weakens the daemon guards — they stay fail-closed.

Out of Scope

• Changing the posture. Whether we should commit to drop-in admissible cohorts and carry the migration burden is a decision, not a measurement, and the graduation deliberately left it open.
• Relaxing any fail-closed guard. The guards are correct; the missing piece is stating the contract they imply.
• Writing the prose upgrade guide. Out of scope because prose is the wrong carrier, not because another ticket owns it — #16447 is closed NOT_PLANNED and owns nothing. The written path is produced from this predicate, for the deployment that needs it, once the capability exists.

Avoided Traps

• Treating absence of a compatibility contract as compatibility. That is precisely today's failure mode: nothing says no, so everything looks admissible until a daemon exits at boot.
• Hand-writing the contract. MigrationPath.md is the standing precedent: a hand-maintained list of these same facts rots into a falsehood, which is why #16447 was opened against it — and re-scoping that ticket away from prose, then closing it, is the team's recorded answer to repairing prose by hand a second time.

Related

• #16448 (parent) · D#16304 (source) · row I of the divergence matrix.
• #16447 — CLOSED / NOT_PLANNED. Re-scoped predecessor superseded by this ticket; cited above only as failed precedent and must not be re-cited as a current path.

Origin Session ID: 9f05cd72-5457-4ec2-926c-ef1406041f19

Retrieval Hint: query_raw_memories("admissibility predicate compatibility contract config overlay fail closed daemons zero hits supportMatrix")