# Model Lifecycle

## Discovery and artifact lifecycle

```text
DISCOVERED
  → CANDIDATE
  → DOWNLOADING
  → QUARANTINED
  → VERIFIED
  → TESTING
  → APPROVED
  → STANDBY / ACTIVE
  → DEPRECATED
  → ARCHIVED
```

Terminal/side states:

- `REJECTED`
- `INCOMPATIBLE`
- `SECURITY_BLOCKED`
- `LICENSE_BLOCKED`

## Deployment channels

- **stable** — production-approved project bindings
- **candidate** — validated candidate awaiting comparison/promotion
- **experimental** — lab-only use
- **archive** — retained for evidence or rollback, not routable by normal project traffic

## Promotion rules

A model/revision becoming downloadable is not a promotion. Promotion changes deployment/channel state and requires evidence.

M4 adds a non-production evidence chain: verified ArtifactSet → static compatibility → exact-set LAB
execution approval → successful RuntimeProbe → `LAB_READY` DeploymentCandidate. This does not move
the Model lifecycle to approved/active, create a stable channel or satisfy benchmark/project gates.

Minimum promotion package:

- immutable model revision;
- approved artifact security status;
- approved license status;
- reproducible runtime profile;
- compatibility probe;
- local benchmark evidence;
- project-specific evidence for affected stable bindings;
- migration plan for non-transparent changes;
- explicit operator approval;
- rollback target.

## Upgrade classification

### transparent

Wire-compatible and expected not to change persisted derived data. Still requires smoke/performance validation.

### behavioral

Same interface but output quality/behavior may change. Requires task/project benchmarks.

### requires_reindex

Persistent vectors/features are incompatible across deployment versions. Requires shadow/backfill/cutover workflow.

### schema_breaking

Output contract changes. Requires capability contract versioning and project migration.

M5 continues without collapsing identities: LAB_READY candidate → exact supply-chain-backed
production approval → stable CapabilityDeployment → cold/warm residency. Promotion does not mutate
the ModelRevision, ArtifactSet, RuntimeProfile or candidate. Drain and deprecation remove routing;
they do not delete provenance. An embedding deployment also creates an immutable EmbeddingSpace,
and any changed identity is `requires_reindex`.

## M12 evidence-bound release lifecycle

M12 makes approval, plan and execution distinct records. Independent integrity, security, runtime,
evaluation, project-fit and deployment dimensions are documented in `LIFECYCLE_STATE_MODEL.md`.
Production needs an exact current ApprovalRequest, an immutable PromotionPlan, a rollback snapshot
and explicit execution. Canary success stops for review. Deprecation and archive never imply physical
deletion; cleanup is a dependency-rechecked operator action. Advisor eligibility remains evidence,
not permission.