# ADR-0009: Node-local artifact acquisition

## Status

Accepted — 2026-08-25

## Decision

The control plane owns Hub metadata, immutable plans and job state. The selected compute node's
outbound agent downloads and verifies bytes against its locally mounted approved storage root.
Artifact operations are a closed typed protocol, not shell/SSH/command execution.

## Consequences

Capacity and path safety are evaluated where the bytes live, GPU Node needs no inbound service, and
credentials/jobs remain node-scoped. SSH remains deployment/debug tooling outside the ModelForge
runtime protocol.