feat(ai): make Docker Agent OS the default deployment posture (#16039) (#16188)

* feat(ai): prepare Docker-canonical local cutover (#16167)

* refactor(ai): make deployment defaults config-owned (#16039)

* docs(ai): map resident MCP endpoint flip (#16167)

* test(ai): pin resident MCP cutover contract (#16167)

* fix(ai): pass seat tokens into Codex launch (#16167)

Author: neo-gpt

.gitignore

@@ -105,6 +105,7 @@ resources/data/reports/
 .env
 .neo-ai-data
 !.neo-ai-data/concepts/
+.neo-ai-secrets
 # Parity-plane runtime root (docker-compose.dev.yml relocated plane) — runtime data, never tracked
 .neo-ai-data-parity
 ai/mcp/server/*/config.mjs

ROADMAP.md

@@ -22,7 +22,7 @@ This section names the gate and the load-bearing path, not a frozen checklist. [
 | **Qt-parity docking + stunning demos** — NL-driven, animated, e2e-tested | [#13158](https://github.com/neomjs/neo/issues/13158) (+ the #14587/#14589/#14590/#14591 batch) | ≥2 public demos with deterministic tour modes; the pillar-1×2 fusion demo (cockpit → docked panel → OS window → share) as the flagship |
 | **Golden Path v2 — the floor** — never empty, direction-attributed, honest states | [#14472](https://github.com/neomjs/neo/issues/14472) · [#14565](https://github.com/neomjs/neo/issues/14565) (subs #14566–#14568) · [#14581](https://github.com/neomjs/neo/issues/14581) | zero-route regression fixed with fixtures (#14588 class); `INTENT_STARVED` renders; the `not-code-ready` backlog re-triaged to honest states |
 | **Local-first Agent OS onboarding** | [#14230](https://github.com/neomjs/neo/issues/14230) | the supported local setup path reaches a running Agent OS / Fleet Manager surface without hand-edited config; fork → running Agent OS → claimed lane → PR is runnable locally |
-| **One Reality — local/cloud Agent OS runtime parity** | [#15798](https://github.com/neomjs/neo/issues/15798) · [D#15595](https://github.com/orgs/neomjs/discussions/15595) · [#15490](https://github.com/neomjs/neo/issues/15490) | the epic's native DAG reaches its declared v13.2 parity-v1 first-self-use gate; Docker-based local/cloud topology parity is proven while stdio remains the contributor fallback |
+| **One Reality — Docker-canonical local/cloud Agent OS** | [#15798](https://github.com/neomjs/neo/issues/15798) · [D#15595](https://github.com/orgs/neomjs/discussions/15595) · [#15490](https://github.com/neomjs/neo/issues/15490) | @tobiu's machine and cloud run one Docker-canonical Agent OS topology; managed seats consume Memory Core and Knowledge Base through the same authenticated HTTP ingress; only irreducibly host-bound wake/session, Neural Link, and repository-workflow effects remain local; native MC/KB stdio, parallel-plane rehearsal, and cutover compatibility paths are removed after the switch |
 | **Brain coherence + runtime discipline** | [#12456](https://github.com/neomjs/neo/issues/12456) (AiConfig cleanup — grind class) · [#14442](https://github.com/neomjs/neo/issues/14442) discipline over A+B's demos | AiConfig cleanup lands without new config drift; demo work proves real product behavior; the CEO-dashboard slice stays gated on [#14472](https://github.com/neomjs/neo/issues/14472) |
 
 **How it runs.** Sequencing honors the coherence-first ordering inside the milestone: the Brain-coherence floor (GP-floor + self-config) and the Local Runtime Parity spine land early; the cockpit PoC and demo polish land on top of the runtime we will actually deploy. Each cornerstone has a self-selected steward driving its outcome — [#15798](https://github.com/neomjs/neo/issues/15798) is stewarded by @neo-fable, and cornerstone 6's business epic [#14442](https://github.com/neomjs/neo/issues/14442) is Grace's on the record. Any peer claims subs. **The AiConfig-cleanup grind ([#12456](https://github.com/neomjs/neo/issues/12456)) is DONE** — closed 2026-07-16 with all ten subs landed, so it is no longer the unclaimed anchor this section named; ADR 0019 plus its lint now hold that floor, and new `ai/` config work consults the ADR rather than this epic. The identity render rules for every cockpit surface are governed by ADR 0032 ([#14445](https://github.com/neomjs/neo/issues/14445) — CLOSED; the ADR is authoritative now, not a pending gate). Cadence: parity is part of the release gate, not an overflow candidate; optional polish yields before One Reality does, and the deferred set holds firm.

ai/configBase.mjs

@@ -405,14 +405,19 @@ class ConfigBase extends ConfigProvider {
                 // Optional username allowlist for PAT modes ('gitlab-pat' / 'github-pat'). Empty means any resolved user.
                 allowedUsers      : leaf([], 'NEO_AUTH_ALLOWED_USERS', 'csv'),
                 /**
-                 * @summary Pins a rosterless local GitHub-PAT process to the provider subject
-                 * resolved from the configured bootstrap carrier before the HTTP listener opens.
+                 * @summary Optional deployment override for the auth-mode-derived provider pin.
                  *
-                 * This is an explicit admission policy, never an alternate meaning for an empty
-                 * `allowedUsers`. Generic PAT profiles remain unchanged while this is `false`.
+                 * Null preserves the safe mode default: GitHub-PAT pins the bootstrap provider
+                 * subject, while auth modes without a provider bootstrap do not. A plural-resident
+                 * GitHub-PAT plane explicitly sets this false; no Compose profile restates true.
+                 * @type {Boolean|null}
+                 */
+                pinFirstProviderSubjectOverride: leaf(null, 'NEO_AUTH_PIN_FIRST_PROVIDER_SUBJECT', 'boolean'),
+                /**
+                 * @summary Effective first-provider-subject policy derived from `auth.mode`.
                  * @type {Boolean}
                  */
-                pinFirstProviderSubject: leaf(false, 'NEO_AUTH_PIN_FIRST_PROVIDER_SUBJECT', 'boolean'),
+                pinFirstProviderSubject: leaf(false),
                 /**
                  * @summary Bootstrap PAT used only when `pinFirstProviderSubject` is enabled.
                  *
@@ -433,13 +438,20 @@ class ConfigBase extends ConfigProvider {
                  * @type {String}
                  */
                 providerBootstrapPatFile: leaf('', 'NEO_AUTH_PROVIDER_BOOTSTRAP_PAT_FILE', 'string'),
-                // Auth provenance sources that may create missing AgentIdentity graph nodes at request time.
-                // 'github-pat' is deliberately NOT in the default: github.com is a public identity
-                // surface, so auto-provisioning must be opt-in for deployments that scope their caller
-                // set (allowedUsers, GHES, private network). Auth success without a bound AgentIdentity
-                // leaves graph-gated tools fail-closed rather than broken — authentication does not
-                // imply Agent OS admission; the exclusion keeps admission explicit instead of ambient.
-                autoProvisionIdentitySources: leaf(['gitlab-pat'], 'NEO_AUTH_AUTO_PROVISION_IDENTITY_SOURCES', 'csv')
+                /**
+                 * @summary Optional deployment override for auth-mode-derived identity provisioning.
+                 *
+                 * Null derives the one provider provenance from `auth.mode`; an explicit empty CSV
+                 * disables provisioning. This keeps selector and derived source in one config
+                 * authority instead of requiring every deployment to repeat the obvious mapping.
+                 * @type {String[]|null}
+                 */
+                autoProvisionIdentitySourcesOverride: leaf(null, 'NEO_AUTH_AUTO_PROVISION_IDENTITY_SOURCES', 'csv'),
+                /**
+                 * @summary Effective request-time identity-provisioning provenance.
+                 * @type {String[]}
+                 */
+                autoProvisionIdentitySources: leaf([])
             },
             /**
              * @summary Deployment-wide chat / generation model provider.
@@ -800,23 +812,22 @@ class ConfigBase extends ConfigProvider {
                 dbPath: leaf(path.resolve(planeDataRootDefault, 'sqlite/memory-core-graph.sqlite'), 'NEO_AI_DB_PATH', 'string', {planeMember: true}),
                 /**
                  * Deployment profile for Agent OS maintenance ownership.
-                 * `local` preserves maintainer-checkout behavior; `cloud` disables local-only
-                 * maintenance lanes unless a narrower localOnly override opts them back in.
+                 * `cloud` is the canonical Agent OS posture and disables local-only maintenance
+                 * lanes unless a host process explicitly opts into `local`.
                  * @type {'local'|'cloud'}
                  */
-                deploymentMode: leaf('local', 'NEO_AI_DEPLOYMENT_MODE', 'string'),
+                deploymentMode: leaf('cloud', 'NEO_AI_DEPLOYMENT_MODE', 'string'),
                 /**
                  * Orchestrator task-authority role. This is intentionally independent from
                  * `deploymentMode`: storage/deployment defaults cannot express which process owns
                  * host/session effects versus plane maintenance on the same machine.
                  *
-                 * `legacy-mixed` preserves existing maintainer checkouts until an explicit
-                 * machine cutover. Container profiles declare `container-plane`; the
-                 * eventual host-edge overlay declares `host-edge`. Unknown values fail the
-                 * orchestrator's preflight ownership audit.
+                 * `container-plane` is the canonical default. A machine-local Orchestrator
+                 * explicitly declares `host-edge`; `legacy-mixed` exists only for rollback to a
+                 * pre-cutover revision. Unknown values fail the preflight ownership audit.
                  * @type {'legacy-mixed'|'host-edge'|'container-plane'}
                  */
-                authorityProfile: leaf('legacy-mixed', 'NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE', 'string'),
+                authorityProfile: leaf('container-plane', 'NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE', 'string'),
                 /**
                  * Filesystem root under which tenant-repo mirrors are stored. The
                  * `deriveTenantRepoMirrorPath` helper appends `tenant-repos/<tenant>/<repo>`,
@@ -1438,14 +1449,14 @@ class ConfigBase extends ConfigProvider {
                  * - `enabled`: whether the orchestrator may supervise `ollama serve` for local-dev
                  *   roles explicitly routed through the native `ollama` provider. The task is
                  *   still omitted when no configured chat / embedding role targets `ollama`, so
-                 *   this default does not start Ollama for the standard OpenAI-compatible setup.
+                 *   the operator must explicitly opt a host edge into supervising Ollama.
                  *   When active, `OLLAMA_HOST`, `OLLAMA_KEEP_ALIVE`, `OLLAMA_CONTEXT_LENGTH`, and
                  *   `OLLAMA_MAX_LOADED_MODELS` are derived from the canonical provider and
                  *   local-model config leaves.
                  * @type {Object}
                  */
                 ollama: {
-                    enabled: leaf(true, 'NEO_ORCHESTRATOR_OLLAMA_ENABLED', 'boolean')
+                    enabled: leaf(false, 'NEO_ORCHESTRATOR_OLLAMA_ENABLED', 'boolean')
                 },
                 /**
                  * Orchestrator-owned LM Studio CLI (`lms`) inference server config. Operators
@@ -1456,8 +1467,8 @@ class ConfigBase extends ConfigProvider {
                  * for local chat + embedding workloads; pick at most one via the respective `enabled` flag.
                  *
                  * - `enabled`: whether the orchestrator should supervise an `lms server start`
-                 *   child process. Enabled by default for local Agent OS chat + embedding roles;
-                 *   **macOS-only** (LM Studio CLI is not
+                 *   child process. Disabled by default: provider processes are deployment choices,
+                 *   not implicit Orchestrator children. The launcher remains **macOS-only** (LM Studio CLI is not
                  *   shipped for Linux containers, so this lane is local-dev substrate, not
                  *   cloud-deployment substrate).
                  * - `model`: legacy single-model field kept for existing operator overlays. The
@@ -1469,7 +1480,7 @@ class ConfigBase extends ConfigProvider {
                  * @type {Object}
                  */
                 lms: {
-                    enabled: leaf(true, 'NEO_ORCHESTRATOR_LMS_ENABLED', 'boolean'),
+                    enabled: leaf(false, 'NEO_ORCHESTRATOR_LMS_ENABLED', 'boolean'),
                     model  : leaf('qwen3-embedding-8b', 'NEO_ORCHESTRATOR_LMS_MODEL', 'string'),
                     port   : leaf('1234', 'NEO_ORCHESTRATOR_LMS_PORT', 'string')
                 }
@@ -1660,6 +1671,10 @@ class ConfigBase extends ConfigProvider {
          * Reactive computed config values (`Neo.state.Provider` formulas).
          */
         formulas: {
+            'auth.pinFirstProviderSubject': data => data.auth.pinFirstProviderSubjectOverride ??
+                data.auth.mode === 'github-pat',
+            'auth.autoProvisionIdentitySources': data => data.auth.autoProvisionIdentitySourcesOverride ??
+                (['github-pat', 'gitlab-pat'].includes(data.auth.mode) ? [data.auth.mode] : []),
             'engines.chroma.useTestDatabase': data => data.engines.chroma.useUnitTestDatabase || data.engines.chroma.useTestHarness,
             'engines.chroma.dataDir'        : data => data.engines.chroma.useTestDatabase ? data.engines.chroma.dataDirTest : data.engines.chroma.dataDirProd,
             'engines.chroma.host'           : data => data.engines.chroma.useTestDatabase ? data.engines.chroma.hostTest    : data.engines.chroma.hostProd,

ai/deploy/Caddyfile.local-agent-os

@@ -0,0 +1,14 @@
+:8080 {
+	route {
+		request_header -X-Preferred-Username
+		request_header -X-Auth-Request-Preferred-Username
+
+		handle_path /mc/* {
+			reverse_proxy mc-server:3001
+		}
+
+		handle_path /kb/* {
+			reverse_proxy kb-server:3000
+		}
+	}
+}

ai/deploy/com.neomjs.agent-os-wake.plist

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  Per-user macOS LaunchAgent template for the final signed, graphless host wake
+  receiver (#16167 / #16180). The cutover runbook materializes the placeholders
+  outside the repository before launchctl bootstrap. It never starts a host
+  Orchestrator or the legacy Shape-C GraphLog daemon.
+-->
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.neomjs.agent-os-wake</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>__NODE_BIN__</string>
+        <string>ai/daemons/wake/receiver.mjs</string>
+        <string>--manifest</string>
+        <string>__WAKE_RECEIVER_MANIFEST__</string>
+        <string>--state-dir</string>
+        <string>__WAKE_RECEIVER_STATE_DIR__</string>
+        <string>--host</string>
+        <string>__WAKE_RECEIVER_HOST__</string>
+        <string>--port</string>
+        <string>__WAKE_RECEIVER_PORT__</string>
+    </array>
+
+    <key>WorkingDirectory</key>
+    <string>__NEO_REPO_ROOT__</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>__NEO_PATH__</string>
+    </dict>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>KeepAlive</key>
+    <true/>
+
+    <key>ThrottleInterval</key>
+    <integer>10</integer>
+
+    <key>StandardOutPath</key>
+    <string>__NEO_REPO_ROOT__/.neo-ai-data/wake-receiver/launchd.out.log</string>
+
+    <key>StandardErrorPath</key>
+    <string>__NEO_REPO_ROOT__/.neo-ai-data/wake-receiver/launchd.err.log</string>
+
+    <key>ProcessType</key>
+    <string>Background</string>
+</dict>
+</plist>

ai/deploy/docker-compose.dev.yml

@@ -101,9 +101,6 @@ x-plane-env: &plane-env
 # renders the credential.
 x-provider-auth-env: &provider-auth-env
   NEO_AUTH_MODE: github-pat
-  NEO_AUTH_TRUST_PROXY_IDENTITY: "false"
-  NEO_AUTH_PIN_FIRST_PROVIDER_SUBJECT: "true"
-  NEO_AUTH_AUTO_PROVISION_IDENTITY_SOURCES: github-pat
   NEO_AUTH_PROVIDER_BOOTSTRAP_PAT_FILE: &provider-bootstrap-pat-file /run/secrets/mcp-auth-token
   NEO_MCP_HEALTHCHECK_TOKEN_FILE: *provider-bootstrap-pat-file
 
@@ -167,11 +164,7 @@ services:
     environment:
       <<: [*plane-env, *provider-auth-env]
       NEO_TRANSPORT: streamable-http
-      NEO_AUTO_SYNC: "false"
-      NEO_KB_AUTO_START_DATABASE: "false"
       NEO_CHROMA_HOST: chroma
-      NEO_CHROMA_PORT: "8000"
-      MCP_HTTP_PORT: "3000"
       # Ask-synthesis pass-throughs (ask_knowledge_base -> SearchService.ask): the synthesis
       # provider + its DEDICATED budget-cappable key (NEO_KB_ASK_API_KEY, never the shared
       # GEMINI_API_KEY). Empty default -> the config-template default applies; with no key the
@@ -236,17 +229,7 @@ services:
     environment:
       <<: [*plane-env, *provider-auth-env]
       NEO_TRANSPORT: streamable-http
-      NEO_MC_PRIMARY: "false"
-      NEO_AUTO_SUMMARIZE: "false"
-      NEO_MEM_AUTO_START_DATABASE: "false"
-      NEO_MEM_AUTO_START_INFERENCE: "false"
-      NEO_AUTO_DREAM: "false"
-      NEO_AUTO_GOLDEN_PATH: "false"
-      NEO_REAL_TIME_MEMORY_PARSING: "false"
-      NEO_AUTO_INGEST_FS: "false"
       NEO_CHROMA_HOST: chroma
-      NEO_CHROMA_PORT: "8000"
-      MCP_HTTP_PORT: "3001"
       # Single-process container hosts the WAL drain loop itself: without it the decoupled
       # add_memory writes the WAL but nothing embeds it, so semantic recall reads empty.
       # Sole-drainer invariant: exactly one loop per WAL dir; never enable alongside the embed
@@ -313,30 +296,15 @@ services:
         SERVICE_ENTRYPOINT: ai/daemons/orchestrator/daemon.mjs
     environment:
       <<: *plane-env
-      # Cloud-safe lane profile: only the deployable lanes run. Local-only lanes and local
-      # inference launchers stay off — the parity stack proves plane topology, not model hosting.
-      NEO_AI_DEPLOYMENT_MODE: cloud
-      NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE: container-plane
-      NEO_ORCHESTRATOR_PRIMARY_DEV_SYNC_ENABLED: "false"
-      NEO_ORCHESTRATOR_CHROMA_DAEMON_ENABLED: "false"
-      NEO_ORCHESTRATOR_KB_SYNC_ENABLED: "false"
-      NEO_ORCHESTRATOR_BRIDGE_DAEMON_ENABLED: "false"
-      NEO_ORCHESTRATOR_GOLDEN_PATH_REPO_ENRICHMENT_ENABLED: "false"
-      NEO_ORCHESTRATOR_MLX_ENABLED: "false"
-      NEO_ORCHESTRATOR_LMS_ENABLED: "false"
-      NEO_ORCHESTRATOR_OLLAMA_ENABLED: "false"
+      # AiConfig owns the cloud/container-plane posture and disabled local/model lanes.
+      # This profile declares only its relocated Chroma placement and Docker capability.
       NEO_CHROMA_HOST: chroma
-      NEO_CHROMA_PORT: "8000"
       # Runtime access is scoped to THIS plane's compose project — the same scalar the project
       # `name` and `NEO_PLANE_ID` resolve from, so a parity orchestrator can never address the
       # native stack's containers.
       NEO_ORCHESTRATOR_RUNTIME_ACCESS_ENABLED: "true"
-      NEO_ORCHESTRATOR_RUNTIME_ACCESS_MECHANISM: docker-socket
-      NEO_ORCHESTRATOR_RUNTIME_ACCESS_SOCKET_PATH: /var/run/docker.sock
       NEO_ORCHESTRATOR_RUNTIME_ACCESS_COMPOSE_PROJECT: *plane-id
       NEO_ORCHESTRATOR_RUNTIME_ACCESS_ALLOWED_SERVICES: chroma,kb-server,mc-server
-      NEO_ORCHESTRATOR_RUNTIME_ACCESS_READ_OPERATIONS: inspect,logs,stats
-      NEO_ORCHESTRATOR_RUNTIME_ACCESS_LIFECYCLE_OPERATIONS: restart
     volumes:
       - ../..:/app
       # The PLANE ROOT rides a project-scoped named volume, not the repo bind above. Docker applies