ModelForge/docs/RELEASE_NOTES_v1.2.0.md

ITWorx ModelForge v1.2.0

v1.2.0 is the Premium Operator Console release. It delivers the M18 operator experience — a live command center, a domain-oriented information architecture, a refined design system and a consistent interaction vocabulary — and closes the three accessibility and form-semantics gaps that M18's own final audit found.

It changes no API contract, no domain model, no runtime behavior and no database schema. An operator upgrading from v1.1.1 replaces application images and nothing else.

Added

• Production command center. A dashboard built only from backend-authoritative evidence: platform posture, production state, GPU Node compute, schedulable headroom and capability health, each stating an unknown as unknown rather than as zero.
• Quick jump. A modal command palette (Ctrl+K) over all 13 workspaces, matching on workspace name, domain and keywords, with direct Enter navigation.
• Evidence timeline. Recent control-plane activity on the dashboard, linking each entry to the workspace where it can be verified.
• Split-pane Registry. Upstream facts, local governance, exact revisions, artifact state and provenance in one traceable detail view.
• Guarded destructive actions. A single console-wide safety dialog that shows identity, dependency posture and permanent impact, and keeps its confirm control disabled until the operator explicitly acknowledges the consequence.

Changed

• Information architecture. Workspaces are grouped by operator mental model — Command, Model supply, Serving, Infrastructure, Assurance, Projects — while every existing route hash is preserved. No route moved and no placeholder route was introduced.
• Design system. One refined token layer: a calm navy surface ramp in dark mode, clean cool neutrals in light mode, semantic status roles that always include text, a 4px spacing grid, explicit focus rings and Geist-first system typography with durable fallbacks.
• Responsive console. Every route is reachable and usable from 1440 px down to a 390 px mobile viewport through a modal navigation drawer, with no horizontal overflow at any tested width.
• No runtime font download, chart library or UI framework was introduced.

Fixed

• The ARIA tabs pattern is now complete across all six tabbed workspaces — Registry, Capabilities, Operations, Recovery, Lifecycle and Migrations. Every tab carries a stable id and aria-controls, and every panel is a real role="tabpanel" naming its tab through aria-labelledby. Assistive technology can now relate a tab to the region it controls.
• Roving keyboard movement now works on every tablist. Lifecycle, Migrations and Recovery previously had tab roles without roving tabindex, an accessible tablist name, or Left/Right/Home/End handling. All six now share one implementation.
• The last native window.confirm is gone. Capability residency unload is guarded by the same safety dialog as every other destructive action, showing channel, residency state, active requests, the VRAM that will be released and the cold-load cost the next request will pay.
• Operator token fields have real form semantics. The Operations, Recovery, Lifecycle and Migrations credential inputs now sit inside a real <form> with a stable id, a name and an explicit <label for>, resolving the browser's "password field is not contained in a form" and "form field element should have an id or name attribute" issues.

Accessibility

• A skip link targets the main workspace landmark, which is programmatically focusable.
• Quick jump and the mobile drawer are modal dialogs with focus containment, Escape dismissal and focus restoration to the control that opened them.
• Status is never encoded by colour alone.
• prefers-reduced-motion: reduce collapses animation and transition durations; forced-colors: active re-expresses focus and active navigation in system colours.
• Essential mobile controls and every navigation row meet a 44 px target.

Security

The operator credential remains request-scoped. It is held in browser memory for the duration of the request and is written to no localStorage, no sessionStorage, no cookie and no URL. Each token form prevents its own default submission, so no credential is ever serialized into a query string.

autocomplete="off" is retained deliberately on every operator-token field. current-password was considered and rejected: it invites a browser password manager to persist and sync a high-privilege control-plane credential, which contradicts the non-persistence guarantee the console makes to the operator. The gap being fixed here was tooling semantics — form membership and stable identifiers — not autofill participation.

Compatibility

Contract	v1.2.0
Version	1.2.0
Channel	stable
Database schema	20260828_0022 — unchanged from v1.1.0/v1.1.1, no migration
Agent protocol	1, accepts 1
Minimum upgrade source	v1.0.0
Minimum PostgreSQL major	16

The Node Agent's functional behavior is unchanged from the NVIDIA-certified v1.1.1 implementation; it is rebuilt and relabelled only because VERSION is the single source of truth for every packaged manifest. No node re-enrollment is required and node identity and credentials are preserved.

Upgrade

Application-only. Schema is 20260828_0022 before and after, so no migration runs.

Known limitations

• Unmanaged GPU workloads can legitimately cause EXTERNAL_GPU_PRESSURE. ModelForge reports and respects that pressure; it does not terminate external workloads.
• Point-in-time database recovery remains NOT_SUPPORTED; verified snapshot restore is the production recovery model.
• The console has no committed visual-regression baseline. Visual acceptance is performed by a human-reviewed browser pass, so future styling drift is not caught automatically.