[codex] durable federation user-unit selection

[8Dionysus]

Summary

• adds durable aoa-install-systemd runtime selection flags for --preset, --profile, repeated/comma selectors, and --restart-now
• closes ABYSS-STACK-Q-0009 by preserving intel-full and layering federation through one host-local user-unit drop-in
• updates deployment/lifecycle docs, cutover packet, decision note, quest routing, generated quest examples, and validator coverage

Root Cause

The live langchain-api federated consumer was enabled, but the systemd user unit restarted an intel-full shape without the federation profile. That removed route-api as outside the selected runtime. The repair keeps the checked-in unit generic and stores host-specific runtime selection in 20-runtime-selection.conf.

Validation

• python scripts/validate_stack.py
• python scripts/validate_nested_agents.py
• python quests/scripts/build_quest_examples.py --check
• python -m pytest -q (263 passed, one upstream Python 3.14/Pydantic warning)
• bash -n scripts/aoa-install-systemd mechanics/runtime-lifecycle/parts/user-unit/aoa_install_systemd.sh
• shellcheck -x scripts/aoa-install-systemd mechanics/runtime-lifecycle/parts/user-unit/aoa_install_systemd.sh
• git diff --check
• aoa checkpoint review-note /home/dionysus/src/abyss-stack --commit-ref 2130bf1ffa2a944f5db8e11407e5d9d3bdc3704f --auto --root /srv/AbyssOS

Live Verification

• synced source to /srv/AbyssOS/abyss-stack/Configs with aoa-sync-configs --delete
• applied /srv/AbyssOS/abyss-stack/Configs/scripts/aoa-install-systemd --preset intel-full --profile federation --enable-now --restart-now
• verified systemctl --user cat podman-compose-abyss.service shows AOA_STACK_PRESET=intel-full and AOA_STACK_PROFILE=federation
• verified aoa-status --autonomy --json passes route-api health, closure, federation layers, and has no degradation reasons
• verified aoa-federated-check --require-enabled
• verified aoa-diagnose --preset intel-full --profile federation --truth-goal deployed exits running_as_intended after cooldown

Skipped

• no private runtime state, secrets, logs, or model artifacts are included in the PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2130bf1ffa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject empty values for runtime-selection flags

aoa_validate_runtime_spec currently treats an empty selector as valid, so --preset= or --profile= passes validation and still writes 20-runtime-selection.conf with empty AOA_STACK_PRESET/AOA_STACK_PROFILE. In the new durable-selection flow, this can silently clear an intended selection (for example in automation when a variable expands to empty) and restart the unit into a different runtime shape than expected, including dropping federation-dependent services.

Useful? React with 👍 / 👎.