3.2 KiB
Lifecycle State Model
M12 adds a lifecycle control layer without collapsing the existing domain identities. Model,
ModelRevision, ModelArtifact, ArtifactSet, RuntimeProfile, RuntimeProbe,
DeploymentCandidate, CapabilityDeployment and ProjectBinding remain separate records.
Independent dimensions
Readiness is expressed as independent evidence, never inferred from one status:
| Dimension | Values used by lifecycle evidence |
|---|---|
| Integrity | UNKNOWN, VERIFIED, CORRUPT |
| Security | UNREVIEWED, APPROVED, BLOCKED |
| Runtime | UNPROBED, PROVEN, INCOMPATIBLE |
| Evaluation | NOT_EVALUATED, EVALUATED, REGRESSED, PROMOTION_ELIGIBLE |
| Project fit | UNKNOWN, REQUIRES_MORE_EVIDENCE, ELIGIBLE, BLOCKED, DEFERRED_EXTERNAL_VALIDATION, KEEP_LAB |
| Deployment | CANDIDATE, LAB_READY, PROMOTION_ELIGIBLE, CANARY, LAB_STABLE, STABLE, DRAINING, DEPRECATED, ARCHIVED |
LAB_READY, engineering PASS, Advisor PROMOTION_ELIGIBLE and an approved request are not
synonyms for production. Production is an explicit environment on a lifecycle subject and requires
an evidence-bound approval, immutable plan, rollback snapshot and separate execution.
Transition graph and concurrency
The typed graph in domain/lifecycle_contracts.py rejects shortcuts. Production follows
STABLE → DRAINING → DEPRECATED → ARCHIVED; restoration from deprecated requires a new explicit
promotion path, not mutation. LAB supports bounded canary and a separate LAB_STABLE state.
Every subject has a monotonically increasing version. Execution compares the operator's expected
version before journaling a change. The database also permits only one production/stable deployment
per capability contract. Conflicts return typed 409 responses; retries use a unique idempotency key.
Every transition creates an append-only LifecycleEvent containing object, before/after state,
actor and role, policy revision, evidence IDs, reason, time and change ID. No inference payload or
secret is stored.
M13 adds an independent migration state graph. It does not collapse backfill or external cutover
truth into deployment lifecycle state; production cutover remains subordinate to a current M12
approval and matching approved requires_reindex promotion plan.
M14 operational integration
Lifecycle failures and rollback failures feed bounded operational metrics/alerts from the existing operation journal. Alert acknowledgement is not lifecycle approval, promotion authority or rollback authority. M14 never executes lifecycle remediation; all production changes still require the M12 evidence-bound policy, immutable plan and explicit actor separation.
M16 reconciliation under fault
An incomplete lifecycle operation is rolled back conservatively from its immutable snapshot on the next control-plane start, exactly once. Restart storms do not accumulate: four consecutive restarts under load produced no authoritative drift.
The lifecycle_commit_has_evidence and no_hidden_auto_promotion invariants assert that no
operation reaches COMMITTED without its plan, approver and executor, and that no production
deployment exists without a recorded production approval.