Package one cumulative provider-lane cutover

Sub of epic #17018 (AC-A documentation tail and AC-D stage 5). This ticket is intentionally unassigned for peer self-selection. It packages the fully proven provider-lane result into one reproducible cutover unit; it does not perform an external deployment.

Context

D#17015 r6 requires a cumulative cutover: canonical-plane falsification first, then one Neo revision plus immutable engine/model coordinates, one declarative external revision, generation election, acceptance, and rollback to both the prior code revision and prior vector generation.

The implementation leaves deliberately separate authority, routing, composition, resource election, coordinated generation, and canonical-scale rebuild. Without a final package, an operator can still copy a partial mix of their outputs and recreate the incident class.

Live duplicate sweep (2026-08-12T12:20Z): searches for cumulative cutover provider and prior revision prior generation rollback found no open implementation ticket beyond parent #17018.

The Problem

A list of merged PRs is not a deployable coordinate. The cutover needs one immutable manifest that answers:

• Which Neo revision contains every required predecessor?
• Which chat and embedding images, model digests, provider roles, service DNS names, contexts, parallelism, and resource allocations were elected?
• Which vector generation is current and which complete prior generation is rollback-retained?
• Which canonical-plane receipts prove composition, containment, joint-load behavior, rebuild validity, and rollback?
• What exact state must an operator verify before and after one cumulative change?

If any field is copied from an older template or inferred from defaults, the package is invalid.

The Architectural Reality

This is a documentation/profile and release-handoff leaf. It consumes authoritative outputs from #17019, #17021, #17022, #17023, #17024, and #17025. It does not add runtime configuration authority or access an external plane.

LlamaCppProfile.md is the existing OpenAI-compatible lane documentation home and must evolve rather than forking a provider concept. Deployment guides must derive facts from the canonical Compose/profile sources where possible; hand-edited duplicate defaults are the version-fossilization mechanism this epic is removing.

The actual external mutation remains operator-gated. Public artifacts use deployment-generic wording and never identify a client.

The Fix

Publish one cumulative cutover package containing:

1. the exact Neo revision with ancestry proof for every required PR,
2. immutable chat/embedding image and model digests,
3. the rendered role → provider → model → DNS lane receipt,
4. elected context, parallelism, and fixed resource allocations,
5. elected current and rollback-retained vector-generation identities,
6. links/checksums for canonical composition, containment, resource-election, rebuild, promotion, and rollback receipts,
7. preflight checks that refuse partial/mismatched coordinates,
8. ordered operator steps for one declarative revision,
9. post-cutover acceptance gates and a rollback procedure that restores code and vector generation together,
10. the engine-pin bump-and-revalidate ritual.

Update the canonical deployment/profile documentation, including LlamaCppProfile.md, without duplicating live defaults into another fossilized template.

Contract Ledger

Acceptance Criteria

• One machine-readable manifest pins the exact Neo revision, both provider image digests, both model digests, service DNS identities, role map, contexts, parallelism, resource allocations, current generation, and rollback generation.
• An ancestry check proves the revision contains every required epic PR; omission or mismatch returns non-success.
• Manifest references/checksums bind all canonical-plane composition, containment, resource-election, rebuild, promotion, and rollback receipts.
• LlamaCppProfile.md and owning deployment documentation describe the role-isolated profile, slot-truth rule, immutable election, and version bump/revalidation ritual without copied stale defaults.
• Operator instructions apply one declarative revision only; there are no external-plane experiments, probes, or staged candidate tests.
• Post-cutover gates verify both role lanes, durable corpus visibility, and elected-generation identity.
• Rollback atomically names both the prior Neo revision and the full prior vector generation; a code-only or collection-partial rollback is refused.
• Package is generated and fully validated on Neo's canonical plane before operator handoff.
• Actual external application remains an explicit L4 operator residual recorded on the epic closeout matrix.

Decision Record Impact

Documents and operationalizes amended ADR-0014. No new ADR or AiConfig leaf is required.

Out of Scope

• Implementing provider routing, validation, resource election, generation authority, or rebuild logic (predecessor subs).
• Running any external-plane test or deployment.
• General release automation unrelated to the provider-lane profile.
• Embedding model-quality selection.

Avoided Traps

• Treating a branch name or latest tag as an immutable revision.
• Copying env defaults into a second template with no revalidation owner.
• Shipping code and vector generations on separate rollback paths.
• Using external deployment as the first integrated test.
• Calling a multi-step partial apply “one revision.”

Related

Parent #17018 · blocked by #17025 · predecessors #17019, #17021, #17022, #17023, #17024 · D#17015 r6

Origin Session ID: 35e0863b-4d45-4b94-90ff-5e66278bea7d

Retrieval hints: D#17015 AC-D cumulative cutover one revision prior generation rollback LlamaCppProfile