Elect the smallest provider-lane envelope that meets the joint SLO

Sub of epic #17018 (Row F, OQ4/OQ6/OQ7, and AC-D validation/election stage). This ticket is intentionally unassigned for peer self-selection and is blocked by #17021's canonical two-lane profile.

Context

D#17015 r6 converged on an Ollama chat lane and OpenAI-compatible embedding lane under one fixed total CPU/memory envelope. The embedding slot count is not prescribed: candidates {1,2,4} must be elected empirically, and the smallest candidate meeting the joint service-level objective wins.

Live duplicate sweep (2026-08-12T12:16Z): open searches for joint load resource election and embedding slot election found only parent #17018 and its composition leaves. No implementation ticket owns this outcome.

The Problem

A two-engine topology can preserve the original contention class if each service independently requests the whole machine. Conversely, choosing four embedding slots because it was the day-one wish can oversubscribe CPU or divide the model context below the required per-slot ceiling.

The relevant knobs are not comparable in isolation:

• llama.cpp-style --ctx-size is total across -np slots; slot truth must be observed at runtime.
• Ollama chat remains parallelism 1 and must retain bounded progress during embedding load.
• Neo's KB, MC, and orchestrator processes create the production concurrency, so a single synthetic caller is not representative.
• queue latency, provider wall time, CPU, memory, and refusal behavior answer different questions.

The Architectural Reality

The election consumes #17021's stable service identities and explicit envelope inputs. It does not create another runtime policy layer. Candidate values are proposed, validated, and either elected or refused; they are never silently clamped or adapted after deployment.

Evidence is generated only on Neo's canonical/disposable plane. No external endpoint, corpus, token, or deployment mutation belongs in this ticket.

The Fix

Build one reproducible election protocol:

1. hold the total CPU and memory envelope fixed,
2. evaluate embedding slot candidates 1, 2, and 4 with chat parallelism 1,
3. allocate lane resources explicitly for every candidate,
4. verify observed per-slot context and refuse a candidate whose slot truth is below the embedding contract,
5. drive production-shaped concurrent embedding callers representing KB, MC, and orchestrator while overlapping a bounded chat workload,
6. record queue wait, provider duration, throughput, CPU, RSS, errors/refusals, and bounded-progress/starvation outcomes per lane,
7. repeat/interleave candidates sufficiently to expose warm-order and model-residency effects,
8. elect the smallest passing candidate and emit its values as immutable declarative deployment inputs.

The runner may reuse existing benchmark primitives, but any new module placement must pass structural pre-flight before implementation.

Contract Ledger

Acceptance Criteria

• Candidates {1,2,4} run under one identical declared total CPU/memory envelope with chat parallelism fixed at 1.
• Every candidate records its explicit per-lane resource allocation and immutable image/model digests.
• Runtime evidence verifies per-slot embedding context; one over-limit request per lane proves refusal rather than silent truncation.
• Workload composition includes concurrent KB-, MC-, and orchestrator-shaped embedding demand plus overlapping chat demand.
• Receipt separates Neo queue wait, provider duration, throughput, CPU, RSS, and errors/refusals; it never labels summed request wall time as CPU utilization.
• Both lanes must make bounded progress with no starvation under the declared joint SLO.
• Candidate order is interleaved/counterbalanced and repeated enough to expose warm-order/residency effects; sample count and uncertainty are reported.
• The smallest fully passing candidate is elected. If none pass, the output is NO_ELECTION.
• Elected values are emitted as immutable declarative inputs consumed by the canonical profile; there is no runtime adaptation or silent clamp.
• All execution is restricted to Neo's canonical/disposable plane; no external-plane probe or data access exists.

Decision Record Impact

Implements Row F and the immutable-election rule in amended ADR-0014. No new ADR or AiConfig leaf is implied.

Out of Scope

• Role routing and Compose/readiness implementation (#17021).
• Composition, containment, and restart-isolation proof (#17022).
• Vector-generation identity/promotion and corpus migration (separate AC-C/AC-E leaves).
• External deployment or acceptance.

Avoided Traps

• Benchmarking one caller against a multi-process production topology.
• Comparing candidates under different total resources.
• Reading configured total context as per-slot context.
• Choosing four because it is the largest candidate.
• Calling request wall time CPU time.
• Hiding a failed matrix behind an automatic fallback.

Related

Parent #17018 · blocked by #17021 · D#17015 r6 · siblings #17019, #17022

Origin Session ID: 35e0863b-4d45-4b94-90ff-5e66278bea7d

Retrieval hints: D#17015 Row F slots 1 2 4 per-slot context joint SLO immutable election