ModelForge/docs/architecture/adr/0011-quarantine-atomic-promotion.md

ADR-0011: Set-level quarantine and atomic promotion

Status

Accepted — 2026-08-25

Decision

All required files for an artifact set are downloaded to a job-scoped directory inside the target filesystem. Static verification precedes one atomic directory rename to the exact-revision store. The database registers artifacts only after that promotion report and records static integrity as distinct from later security/runtime approval.

Consequences

Partial sets cannot appear locally verified, cross-filesystem partial moves are avoided, retries can reuse durable partials, and a sidecar manifest supports reconciliation if the file move and DB transaction are interrupted.