Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,31 @@
+# ADR-0041: Authoritative versus rebuildable recovery state
+
+## Status
+
+Accepted in M15 on 2026-08-27.
+
+## Decision
+
+Classify every persisted state source as `AUTHORITATIVE`, `REBUILDABLE`, `EPHEMERAL`, `EXTERNAL` or
+`SECRET` in a versioned `RecoveryPolicyRevision`, and enforce the classification in the contract:
+authoritative state may not declare a manifest-only or absent backup and must state an RPO,
+ephemeral state may not claim a payload backup, external state must be marked as a dependency,
+secret state must name a secret recovery class, and only rebuildable state may be rehydrated.
+
+Partition the database itself along the same line. Fingerprinted history is compared across a
+restore; `CURRENT_TRUTH_TABLES` — NVML telemetry, GPU leases, residency, inventory runs, storage
+volume states — is cleared during reconciliation and re-measured by a running control plane. A test
+asserts the two sets together cover the whole schema.
+
+## Consequences
+
+Recovery cost is proportional to what is genuinely irreplaceable: a 5 MB encrypted control-plane
+dump protects the provenance, lifecycle, migration, approval and audit truth, while 8.1 GB of model
+weights are protected by exact-revision manifests instead of being copied.
+
+A restored control plane cannot present a stale GPU lease or a dead NVML reading as present-day
+fact, and the `READY` gate refuses to pass while any current-truth row survives. External projects
+are recorded as dependencies rather than silently claimed as backed up.
+
+The cost is that a new milestone must classify every table it adds. The invariant test makes that a
+build failure rather than a silent recovery gap.