Receive Agent OS deployment and prove the Brain image

Context

ai/deploy/** is part of Wave 3 and changed between the currently deployed pin and current dev. This leaf moves deployment authority only after the source/package receive is green, then proves a Brain-built image before Neo removal.

Wave 0 owns the live baseline and the image-pin + named-bundle rollback pair. This leaf consumes that receipt; it does not replace or redo Wave 0.

The Problem

Moving source without deployment leaves the running Agent OS tied to Neo paths. Moving deployment too early can rebuild against incomplete package topology or destroy the very rollback surface the cut needs.

The Architectural Reality

• ai/deploy/ contains compose profiles, Dockerfile/Caddy profiles, host plists, and provider/deployment fixtures.
• ADR 0040 makes Container Cloud a nested package and Host Edge the root.
• Wave 0 provides the pre-cut image-pin + named-bundle rollback authority and must be green first.
• Wave 4 owns the severe production battery; this leaf owes bounded receive/image health only.

The Fix

Move every cut-manifest-classified deployment artifact into the Brain repo, rewrite build contexts and paths to the received package topology, preserve config/secrets SSOT, build the Brain-owned image at the received SHA, and run bounded MC/KB/container health against a disposable or operator-approved environment.

Definitions move here; privileged plist installation and final production re-point remain operator/Wave-4 actions.

Contract Ledger Matrix

Decision Record impact

amends ADR 0040 §2.7 deployment custody and depends-on ADR 0019.

Decision Record

Required: ADR 0040 amendment lands with the Wave-3 custody stream; no new deployment topology is invented.

Acceptance Criteria

• Every ai/deploy/** mover in the cut manifest exists once in the Brain target and no unclassified deployment artifact remains.
• Docker/compose/Caddy/build contexts resolve entirely inside Brain topology or the published Engine package; no Neo checkout path fallback.
• Root Edge and nested Cloud installs/builds remain independent; no workspace/ancestor-hoist dependency.
• Config templates and overlay migration obey ADR 0019; secrets and live operator values are never committed.
• A Brain-built image carries the exact received Brain SHA and starts the bounded container set without Neo source.
• MC and KB healthchecks pass against the Brain image; revision and image digest are recorded.
• Wave-0 image-pin + named-verified-bundle rollback pair is read back before the proof; missing/stale rollback blocks.
• Host plist/service definitions reference agentosRuntimeRoot; installation remains explicitly operator-owned.
• Neo still retains source/deployment definitions until the terminal removal leaf.
• Evidence is sufficient for removal gating but does not claim Wave-4 severe continuity.

Out of Scope

• Wave-0 repair/bundle/pin implementation;
• final production container update;
• severe MC write+recall, KB moved-learn query, wake/fleet/FM battery;
• seat/runtime target re-point;
• Neo-side deletion.

Avoided Traps

• Build from Neo after “moving” deployment: leaves authority behind.
• Health without revision: can test the old image.
• Image-only rollback: ignores the named verified bundle.
• Commit live overlays: leaks secrets and creates a second config authority.
• Claim Wave-4 completion from a bounded smoke.

Related

Blocked by: #17788 and Wave 0 green receipt
Parent Wave-3 Epic: #17786

Handoff Retrieval Hints

Retrieval Hint: ai/deploy relocation Brain image bounded MC KB health Wave0 rollback pair

Origin Session ID: 975b7d3f-ebb0-46bd-8b5a-ac7fa64ba0d0