ModelForge/docs/architecture/adr/0030-operational-project-bindings-and-fit-evidence.md

ADR-0030: Operational project bindings and immutable project-fit evidence

Status

Accepted in M11.

Decision

An external consumer is operational only through a scoped service identity bound to one real ProjectBinding. Project environment, purpose and server-owned QoS are attributes of that identity. Project-fit conclusions are separate immutable evidence records bound to the project contract and, when applicable, the exact deployment.

Consequences

Planning manifests cannot masquerade as live usage. Consumers cannot select a model, runtime, worker, node or priority. Credential rotation preserves binding identity while revoking the old secret. Project-fit evidence can explain readiness but cannot promote. Usage and “Why Installed” can be derived from domain relations without storing content or adding project-specific gateway routes.