Initial public ModelForge release

docs/RELEASE_NOTES_v1.2.0.md

@@ -0,0 +1,104 @@
+# ITWorx ModelForge v1.2.0
+
+v1.2.0 is the Premium Operator Console release. It delivers the M18 operator experience — a live
+command center, a domain-oriented information architecture, a refined design system and a
+consistent interaction vocabulary — and closes the three accessibility and form-semantics gaps that
+M18's own final audit found.
+
+It changes no API contract, no domain model, no runtime behavior and no database schema. An
+operator upgrading from v1.1.1 replaces application images and nothing else.
+
+## Added
+
+- **Production command center.** A dashboard built only from backend-authoritative evidence:
+  platform posture, production state, GPU Node compute, schedulable headroom and capability health,
+  each stating an unknown as unknown rather than as zero.
+- **Quick jump.** A modal command palette (Ctrl+K) over all 13 workspaces, matching on workspace
+  name, domain and keywords, with direct Enter navigation.
+- **Evidence timeline.** Recent control-plane activity on the dashboard, linking each entry to the
+  workspace where it can be verified.
+- **Split-pane Registry.** Upstream facts, local governance, exact revisions, artifact state and
+  provenance in one traceable detail view.
+- **Guarded destructive actions.** A single console-wide safety dialog that shows identity,
+  dependency posture and permanent impact, and keeps its confirm control disabled until the operator
+  explicitly acknowledges the consequence.
+
+## Changed
+
+- **Information architecture.** Workspaces are grouped by operator mental model — Command, Model
+  supply, Serving, Infrastructure, Assurance, Projects — while every existing route hash is
+  preserved. No route moved and no placeholder route was introduced.
+- **Design system.** One refined token layer: a calm navy surface ramp in dark mode, clean cool
+  neutrals in light mode, semantic status roles that always include text, a 4px spacing grid,
+  explicit focus rings and Geist-first system typography with durable fallbacks.
+- **Responsive console.** Every route is reachable and usable from 1440 px down to a 390 px mobile
+  viewport through a modal navigation drawer, with no horizontal overflow at any tested width.
+- No runtime font download, chart library or UI framework was introduced.
+
+## Fixed
+
+- **The ARIA tabs pattern is now complete across all six tabbed workspaces** — Registry,
+  Capabilities, Operations, Recovery, Lifecycle and Migrations. Every tab carries a stable `id` and
+  `aria-controls`, and every panel is a real `role="tabpanel"` naming its tab through
+  `aria-labelledby`. Assistive technology can now relate a tab to the region it controls.
+- **Roving keyboard movement now works on every tablist.** Lifecycle, Migrations and Recovery
+  previously had tab roles without roving `tabindex`, an accessible tablist name, or
+  Left/Right/Home/End handling. All six now share one implementation.
+- **The last native `window.confirm` is gone.** Capability residency unload is guarded by the same
+  safety dialog as every other destructive action, showing channel, residency state, active
+  requests, the VRAM that will be released and the cold-load cost the next request will pay.
+- **Operator token fields have real form semantics.** The Operations, Recovery, Lifecycle and
+  Migrations credential inputs now sit inside a real `<form>` with a stable `id`, a `name` and an
+  explicit `<label for>`, resolving the browser's "password field is not contained in a form" and
+  "form field element should have an id or name attribute" issues.
+
+## Accessibility
+
+- A skip link targets the main workspace landmark, which is programmatically focusable.
+- Quick jump and the mobile drawer are modal dialogs with focus containment, Escape dismissal and
+  focus restoration to the control that opened them.
+- Status is never encoded by colour alone.
+- `prefers-reduced-motion: reduce` collapses animation and transition durations; `forced-colors:
+  active` re-expresses focus and active navigation in system colours.
+- Essential mobile controls and every navigation row meet a 44 px target.
+
+## Security
+
+The operator credential remains request-scoped. It is held in browser memory for the duration of the
+request and is written to no `localStorage`, no `sessionStorage`, no cookie and no URL. Each token
+form prevents its own default submission, so no credential is ever serialized into a query string.
+
+`autocomplete="off"` is retained deliberately on every operator-token field. `current-password` was
+considered and rejected: it invites a browser password manager to persist and sync a
+high-privilege control-plane credential, which contradicts the non-persistence guarantee the console
+makes to the operator. The gap being fixed here was tooling semantics — form membership and stable
+identifiers — not autofill participation.
+
+## Compatibility
+
+| Contract | v1.2.0 |
+| --- | --- |
+| Version | `1.2.0` |
+| Channel | `stable` |
+| Database schema | `20260828_0022` — unchanged from v1.1.0/v1.1.1, no migration |
+| Agent protocol | `1`, accepts `1` |
+| Minimum upgrade source | `v1.0.0` |
+| Minimum PostgreSQL major | `16` |
+
+The Node Agent's functional behavior is unchanged from the NVIDIA-certified v1.1.1 implementation;
+it is rebuilt and relabelled only because `VERSION` is the single source of truth for every
+packaged manifest. No node re-enrollment is required and node identity and credentials are
+preserved.
+
+## Upgrade
+
+Application-only. Schema is `20260828_0022` before and after, so no migration runs.
+
+## Known limitations
+
+- Unmanaged GPU workloads can legitimately cause `EXTERNAL_GPU_PRESSURE`. ModelForge reports and
+  respects that pressure; it does not terminate external workloads.
+- Point-in-time database recovery remains `NOT_SUPPORTED`; verified snapshot restore is the
+  production recovery model.
+- The console has no committed visual-regression baseline. Visual acceptance is performed by a
+  human-reviewed browser pass, so future styling drift is not caught automatically.