ModelForge/docs/architecture/adr/0031-deferred-owner-photo-validation-and-evidence-classes.md

ADR-0031: Deferred owner-photo validation and visual evidence classes

Status

Accepted in M11 on 2026-08-26.

Context

M11 proved ExampleVision's capability-first shadow integration, complete reference index, scoped credentials, privacy boundary, Gateway/Scheduler/GPU Node execution and bounded QoS. It did not receive an independently reviewed owner-photo dataset. Treating that external data dependency as an unbounded engineering blocker conflated integration readiness with project production fitness.

Catalog artwork cannot prove camera robustness. Public physical captures can improve robustness evidence, but their licenses, provenance and labels vary and they cannot substitute for ExampleVision production captures when calibrating automatic decisions.

Decision

Visual project evidence has one immutable class:

• OWNER_PHOTO: physical-card captures from the target user/project context, independently labelled;
• PUBLIC_PHYSICAL_CAPTURE: licensed, provenance-reviewed physical-card captures from a public source;
• CATALOG_REFERENCE: official/reference artwork or derivatives used only for index, embedding and technical route validation.

ProjectFitEvidence also records separate immutable statements for engineering integration, project-production recommendation, production validation and production action. Engineering may be PASS while project production fit remains REQUIRES_MORE_EVIDENCE and production action remains NONE.

M11 engineering closure does not require owner photos. The separate POKEVAULT_VISION_PRODUCTION_VALIDATION gate does. It can be SATISFIED only by non-empty, independently reviewed OWNER_PHOTO evidence with zero critical errors and blockers and an eligible project-fit recommendation. Public physical captures and catalog references are rejected as production-gate substitutes.

The M11 release taxonomy is:

• PASS;
• PASS WITH DEFERRED EXTERNAL VALIDATION;
• PASS WITH DOCUMENTED CANDIDATE LIMITATIONS;
• BLOCKED.

M11 uses PASS WITH DEFERRED EXTERNAL VALIDATION while owner-photo validation is absent.

Consequences

• M11 can close after its engineering gates pass without claiming real-photo accuracy.
• VISION_AUTO_ACCEPT=false and ExampleVision human confirmation remain mandatory.
• Existing Vision evidence remains immutable and REQUIRES_MORE_EVIDENCE.
• No public dataset result can activate automatic recognition or satisfy production validation.
• A later production proposal must bind owner-photo dataset revision, independent ground truth, leakage checks, critical/false-confident results, frozen calibration and explicit approval.
• Advisor and UI expose engineering, project-fit, production-gate and action state separately.

Rejected alternatives

• Keeping M11 indefinitely blocked: this makes an external manual data-collection activity part of engineering completion despite a proven shadow integration.
• Treating catalog artwork as real-photo evidence: this hides the camera-domain gap.
• Treating public captures as owner photos: this loses project provenance and calibration relevance.
• Enabling auto-accept from public data alone: this bypasses the project-specific production gate.