Initial public ModelForge release

docs/architecture/ERROR_BUDGETS.md

@@ -0,0 +1,25 @@
+# Error budgets
+
+Error budgets apply only to `PRODUCTION` SLO policies.
+
+For a window with population `N`, objective `O` and bad count `B`:
+
+```text
+allowed_bad  = (1 - O) × N
+consumed_bad = B
+remaining    = max(0, allowed_bad - B)
+burn_rate    = (B / N) / (1 - O)
+```
+
+The long burn rate uses the complete rolling policy window. The short burn rate uses the last five
+minutes, bounded by the policy window. Latency bad events are completed requests over the exact
+policy threshold; success-ratio bad events are valid terminal failures.
+
+An operational capability can be serving while consuming budget. The UI therefore shows SLO state,
+observed value and budget separately. `remaining=0` is not rewritten as a capability outage, and an
+acknowledged alert does not restore budget.
+
+Windows roll naturally as old events leave the population. A new evaluation is an immutable
+snapshot, so recovery is demonstrated by later snapshots rather than rewriting history. LAB and
+BACKGROUND evaluations have `allowed_bad`, `consumed_bad`, `remaining` and burn rates unset by
+default.