Container-plane tenant-repo sync bypasses the global maintenance lease

Context

At origin/dev@94aba2b7e7550abb5299d05c30b6964342a6c35d, ai/scripts/maintenance/syncTenantRepos.mjs is a container-plane one-shot entrypoint bundled inside the Neo deployment image. It executes inside the orchestrator container under deployment-side authority. It is not a host-side Agent OS tool, and Neo maintainers without access to the deployment server cannot invoke it remotely.

The periodic tenant-repo-sync task and dream are both registered as backpressure: "exclusive-heavy". MaintenanceBackpressureService admits supervised heavy work through the deployment-wide heavy-maintenance-lease.json.

The container entrypoint bypasses that outer gate and calls TenantRepoSyncService.runTask() directly. The service then acquires only its dedicated tenant-repo-sync-lease.json.

Closed #15763 intentionally added that dedicated lease to serialize periodic and one-shot tenant-sync processes over the revisions manifest. Its Out of Scope explicitly excluded Dream and unrelated maintenance, so this is a new cross-task successor rather than a reopen.

Freshness sweep: latest 20 open issues plus full-history title/body searches were checked before filing; no open duplicate was found. The current Codex tool surface did not expose the A2A mailbox APIs, so collision authority was verified through the live GitHub assignee and open-PR surfaces instead; no mailbox no-overlap claim is made.

Structure ownership is existing files only: syncTenantRepos.mjs, HeavyMaintenanceLeaseService.mjs, and manualHeavyMaintenanceScriptLeaseAdoption.spec.mjs. No new module is required.

The Problem

A deployment-side one-shot tenant sync can enter while REM, backup, summary, or another incompatible heavy task holds the global lease.

Separate model endpoints do not make that overlap safe: the lanes still share canonical Chroma, SQLite, graph, and maintenance authority. The supervised scheduler would defer the same tenant-sync work, while the container entrypoint silently bypasses that contract.

Architectural Reality

Two leases serve complementary boundaries:

• Global heavy-maintenance lease: cross-task exclusion among incompatible heavy lanes.
• Dedicated tenant-repo-sync lease: same-lane serialization and revision-manifest integrity across periodic and one-shot processes.

The fix adds the missing outer gate and preserves the dedicated inner lease.

Invocation authority remains deployment-side. This ticket does not grant Neo maintainers, agents, or workstation tools access to an external deployment.

The Fix

1. Wrap the container entrypoint dispatch with the existing withHeavyMaintenanceLease() primitive.
2. Resolve the canonical global lease path from AiConfig.orchestrator.dataDir and use the existing tenant-repo-sync owner identity.
3. Acquire the global lease before invoking TenantRepoSyncService.runTask() or producing ingestion side effects.
4. Preserve the service-level dedicated tenant-sync lease unchanged.
5. Map a globally-held result to the existing bounded busy class: deterministic exit code 4, stable diagnostic, and no checkpoint or backoff mutation.
6. Release the outer lease on completion, returned failure, and thrown error.
7. Add this entrypoint to the existing manual-heavy-script adoption census and add a behavior witness proving a held global lease prevents the service call.

Contract Ledger Matrix

Decision Record Impact

aligned-with ADR 0014 and the current orchestrator heavy-maintenance contract. No ADR amendment.

Acceptance Criteria

• While any incompatible exclusive-heavy owner holds the global lease, the container entrypoint does not invoke TenantRepoSyncService.runTask().
• Global contention returns a stable bounded diagnostic and exit code 4, with no checkpoint, revision, failure-counter, or backoff mutation.
• After global admission, the dedicated tenant-sync lease still serializes periodic and one-shot processes.
• The outer lease releases after success, returned failure, and thrown error.
• The entrypoint is covered by the existing adoption census and a behavior-level held-lease witness.
• Existing --repo-slug, --full, and non-contention exit behavior remains unchanged.
• No new scheduler, queue, lease primitive, module, deployment branch, or remote actuator is introduced.

Out of Scope

• Granting Neo maintainers or agent processes deployment-server execution authority.
• Running this entrypoint from a maintainer workstation or through Agent OS.
• Heavy-maintenance fairness or preemption policy (#16561 / #16566).
• Replacing the dedicated lease from #15763.
• Provider routing, model allocation, or deployment-local Compose drift.

Avoided Traps

• Do not describe this as a remotely runnable operator CLI.
• Do not replace the dedicated lease with the global lease.
• Do not treat global contention as an ingestion failure.
• Do not add a scheduler, queue, remote actuator, or new lease primitive.

Related

• #15763 / PR #15772 — dedicated same-lane serialization.
• #16561 / #16566 — heavy-maintenance fairness; distinct from this bypass.
• #16283 / PR #16285 — canonical authority-lease healthcheck; deployment drift is separate.

Handoff Retrieval Hint: container-plane syncTenantRepos one-shot entrypoint global heavy-maintenance lease dream exclusive-heavy dedicated tenant-repo-sync lease