# ADR-0030: Operational project bindings and immutable project-fit evidence

## Status

Accepted in M11.

## Decision

An external consumer is operational only through a scoped service identity bound to one real
`ProjectBinding`. Project environment, purpose and server-owned QoS are attributes of that identity.
Project-fit conclusions are separate immutable evidence records bound to the project contract and,
when applicable, the exact deployment.

## Consequences

Planning manifests cannot masquerade as live usage. Consumers cannot select a model, runtime, worker,
node or priority. Credential rotation preserves binding identity while revoking the old secret.
Project-fit evidence can explain readiness but cannot promote. Usage and “Why Installed” can be
derived from domain relations without storing content or adding project-specific gateway routes.