1.7 KiB
Dependency-Aware Cleanup
Cleanup is plan-first and dry-run by default. A LifecycleCleanupPlan records the exact object,
dependency graph, digest, reclaimable bytes, retention state, blockers and proposed action.
Artifact-set checks cover active locations, derived artifacts, candidates, profiles, execution and
production approvals, capability deployments/routes, project bindings, evaluation runs, embedding
spaces/migrations, lifecycle evidence and retention. Location checks distinguish one node-local copy
from remaining copies. Database foreign keys use RESTRICT; there are no hidden destructive
cascades.
Execution requires an operator credential and explicit confirmation, re-resolves the graph and
compares its digest. Changed dependencies make the plan STALE; active dependencies or retention
return typed 409 conflicts. ModelForge records a location removal only after the typed storage action
confirms physical completion. Retrying after a crash reconciles the same plan; removal records retain
prior status, digest, size, actor and time. Model, revision, hashes, evaluation, deployments and audit
are never erased by binary-location cleanup.
M13 dependency discovery also reports MIGRATION_PLAN_SOURCE and MIGRATION_PLAN_TARGET when an
artifact set appears in an active plan identity or a retained rollback snapshot. The execution-time
digest recheck prevents cleanup racing a newly planned migration.
Node lifecycle extension
Node decommission applies the same fail-closed principle to compute infrastructure. Its preview
enumerates blockers, current truth to remove and provenance to retain; execute repeats that graph
under transaction locks and has no force override. See NODE_DECOMMISSION.md.