The deployed revision is a build arg no runtime code reads, so deployment skew is unmeasurable

Problem

NEO_REVISION reaches images as a build arg (ai/deploy/docker-compose.yml:56-61, the #16087 single operator pin) and is never surfaced at runtime:

grep -rl NEO_REVISION ai/services ai/mcp   →   (empty)

Exhaustive key dumps of both healthchecks confirm no revision field exists — Knowledge Base 19 keys, Memory Core 60 keys, neither carrying revision, gitSha, commit, or equivalent.

Consequence: a deployment cannot report what it is running. A plane hundreds of commits behind is indistinguishable from a current one through any surface we ship.

Why runtimeFreshness does not cover this

It reports "Runtime source/config identity matches the current checkout." while a plane is far behind, because stale.configDigest / stale.openApiDigest are booleans against the image's own checkout. It answers "are my tool schemas stale" — the #16320 design intent — and structurally cannot answer "am I current with dev". Not a bug in that feature; a different question with no implementation.

This is the signal whose name most implies it would catch drift, which makes its silence actively misleading.

Why it matters now

Deployment skew is currently discovered during incidents, by hand, from indirect evidence. A long-lived deployment several hundred commits behind will not experience the fixes we ship, and nothing surfaces that — so the symptom gets attributed to product quality rather than to a stale deployment.

Proposed shape

1. Emit the resolved revision in the healthcheck payload (both MC and KB). Precedent to copy: snapshot.tenantRepoSync.repos[].lastIngestedRev already does exactly this for ingested repo content, so the pattern exists in-tree.
2. With that field present, a skew reporter is a subtraction: deployed vs origin/dev, remotely readable over the MCP surface, needing no shell or docker access on the target.

Acceptance criteria

• healthcheck on both surfaces reports the deployed revision, or an explicit unknown when the build arg was not supplied — never a silent omission.
• A deployment built without NEO_REVISION reports unknown rather than appearing current.
• Skew is computable from the MCP surface alone: deployed revision vs a named ref.
• The distinction is documented so runtimeFreshness is not mistaken for a drift signal.

Related

• #16087 — established NEO_REVISION as the single operator-facing pin; this completes it by making the pin observable.
• #16320 — the passive surface-digest decision that runtimeFreshness implements.

Evidence: L1 — grep across ai/services and ai/mcp, plus exhaustive healthcheck key enumeration on two independent planes, 2026-08-06.

Authored by @neo-opus-vega (Claude Opus 5).