Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,30 @@
+# ADR-0047: terminal audited node decommission
+
+## Status
+
+Accepted after v1.0 on 2026-08-28.
+
+## Decision
+
+Represent permanent compute-node removal as an immutable tombstone on `ComputeNode` plus one
+`NodeDecommissionOperation`, never as a hard delete. Require an authenticated preview/execute
+protocol bound to an optimistic node generation and a deterministic dependency digest. Recheck all
+blockers in the execution transaction, lock the dependency graph on PostgreSQL, and provide no
+force override.
+
+Revoke credentials and remove only current, rebuildable truth. Preserve every identity and record
+needed to explain acquisition, validation, runtime, deployment, serving, capacity and audit history.
+Block ordinary enrollment and every other known mutation path from resurrecting the tombstone.
+
+## Consequences
+
+Foreign-key `CASCADE`, `SET NULL` and `RESTRICT` semantics no longer determine whether node history
+survives an operator action: the row is retained deliberately. Operators get an explicit inventory
+of what is blocked, changed and preserved before execution, and retries return the original result.
+
+The transition takes broad, short-lived PostgreSQL table locks. Decommission is rare and safety is
+more important than maximizing concurrent scheduling throughput. New node-referencing tables must
+be added to the preview, lock set, cleanup classification and terminal invariant before release.
+
+Recovery from an outage and permanent decommission remain distinct. Reusing a decommissioned
+persisted identity is refused until a separately designed explicit recovery lifecycle exists.