# ITWorx ModelForge v1.2.0

v1.2.0 is the Premium Operator Console release. It delivers the M18 operator experience — a live
command center, a domain-oriented information architecture, a refined design system and a
consistent interaction vocabulary — and closes the three accessibility and form-semantics gaps that
M18's own final audit found.

It changes no API contract, no domain model, no runtime behavior and no database schema. An
operator upgrading from v1.1.1 replaces application images and nothing else.

## Added

- **Production command center.** A dashboard built only from backend-authoritative evidence:
  platform posture, production state, GPU Node compute, schedulable headroom and capability health,
  each stating an unknown as unknown rather than as zero.
- **Quick jump.** A modal command palette (Ctrl+K) over all 13 workspaces, matching on workspace
  name, domain and keywords, with direct Enter navigation.
- **Evidence timeline.** Recent control-plane activity on the dashboard, linking each entry to the
  workspace where it can be verified.
- **Split-pane Registry.** Upstream facts, local governance, exact revisions, artifact state and
  provenance in one traceable detail view.
- **Guarded destructive actions.** A single console-wide safety dialog that shows identity,
  dependency posture and permanent impact, and keeps its confirm control disabled until the operator
  explicitly acknowledges the consequence.

## Changed

- **Information architecture.** Workspaces are grouped by operator mental model — Command, Model
  supply, Serving, Infrastructure, Assurance, Projects — while every existing route hash is
  preserved. No route moved and no placeholder route was introduced.
- **Design system.** One refined token layer: a calm navy surface ramp in dark mode, clean cool
  neutrals in light mode, semantic status roles that always include text, a 4px spacing grid,
  explicit focus rings and Geist-first system typography with durable fallbacks.
- **Responsive console.** Every route is reachable and usable from 1440 px down to a 390 px mobile
  viewport through a modal navigation drawer, with no horizontal overflow at any tested width.
- No runtime font download, chart library or UI framework was introduced.

## Fixed

- **The ARIA tabs pattern is now complete across all six tabbed workspaces** — Registry,
  Capabilities, Operations, Recovery, Lifecycle and Migrations. Every tab carries a stable `id` and
  `aria-controls`, and every panel is a real `role="tabpanel"` naming its tab through
  `aria-labelledby`. Assistive technology can now relate a tab to the region it controls.
- **Roving keyboard movement now works on every tablist.** Lifecycle, Migrations and Recovery
  previously had tab roles without roving `tabindex`, an accessible tablist name, or
  Left/Right/Home/End handling. All six now share one implementation.
- **The last native `window.confirm` is gone.** Capability residency unload is guarded by the same
  safety dialog as every other destructive action, showing channel, residency state, active
  requests, the VRAM that will be released and the cold-load cost the next request will pay.
- **Operator token fields have real form semantics.** The Operations, Recovery, Lifecycle and
  Migrations credential inputs now sit inside a real `<form>` with a stable `id`, a `name` and an
  explicit `<label for>`, resolving the browser's "password field is not contained in a form" and
  "form field element should have an id or name attribute" issues.

## Accessibility

- A skip link targets the main workspace landmark, which is programmatically focusable.
- Quick jump and the mobile drawer are modal dialogs with focus containment, Escape dismissal and
  focus restoration to the control that opened them.
- Status is never encoded by colour alone.
- `prefers-reduced-motion: reduce` collapses animation and transition durations; `forced-colors:
  active` re-expresses focus and active navigation in system colours.
- Essential mobile controls and every navigation row meet a 44 px target.

## Security

The operator credential remains request-scoped. It is held in browser memory for the duration of the
request and is written to no `localStorage`, no `sessionStorage`, no cookie and no URL. Each token
form prevents its own default submission, so no credential is ever serialized into a query string.

`autocomplete="off"` is retained deliberately on every operator-token field. `current-password` was
considered and rejected: it invites a browser password manager to persist and sync a
high-privilege control-plane credential, which contradicts the non-persistence guarantee the console
makes to the operator. The gap being fixed here was tooling semantics — form membership and stable
identifiers — not autofill participation.

## Compatibility

| Contract | v1.2.0 |
| --- | --- |
| Version | `1.2.0` |
| Channel | `stable` |
| Database schema | `20260828_0022` — unchanged from v1.1.0/v1.1.1, no migration |
| Agent protocol | `1`, accepts `1` |
| Minimum upgrade source | `v1.0.0` |
| Minimum PostgreSQL major | `16` |

The Node Agent's functional behavior is unchanged from the NVIDIA-certified v1.1.1 implementation;
it is rebuilt and relabelled only because `VERSION` is the single source of truth for every
packaged manifest. No node re-enrollment is required and node identity and credentials are
preserved.

## Upgrade

Application-only. Schema is `20260828_0022` before and after, so no migration runs.

## Known limitations

- Unmanaged GPU workloads can legitimately cause `EXTERNAL_GPU_PRESSURE`. ModelForge reports and
  respects that pressure; it does not terminate external workloads.
- Point-in-time database recovery remains `NOT_SUPPORTED`; verified snapshot restore is the
  production recovery model.
- The console has no committed visual-regression baseline. Visual acceptance is performed by a
  human-reviewed browser pass, so future styling drift is not caught automatically.