58 lines
3.2 KiB
Markdown
58 lines
3.2 KiB
Markdown
# Lifecycle State Model
|
|
|
|
M12 adds a lifecycle control layer without collapsing the existing domain identities. `Model`,
|
|
`ModelRevision`, `ModelArtifact`, `ArtifactSet`, `RuntimeProfile`, `RuntimeProbe`,
|
|
`DeploymentCandidate`, `CapabilityDeployment` and `ProjectBinding` remain separate records.
|
|
|
|
## Independent dimensions
|
|
|
|
Readiness is expressed as independent evidence, never inferred from one status:
|
|
|
|
| Dimension | Values used by lifecycle evidence |
|
|
| --- | --- |
|
|
| Integrity | `UNKNOWN`, `VERIFIED`, `CORRUPT` |
|
|
| Security | `UNREVIEWED`, `APPROVED`, `BLOCKED` |
|
|
| Runtime | `UNPROBED`, `PROVEN`, `INCOMPATIBLE` |
|
|
| Evaluation | `NOT_EVALUATED`, `EVALUATED`, `REGRESSED`, `PROMOTION_ELIGIBLE` |
|
|
| Project fit | `UNKNOWN`, `REQUIRES_MORE_EVIDENCE`, `ELIGIBLE`, `BLOCKED`, `DEFERRED_EXTERNAL_VALIDATION`, `KEEP_LAB` |
|
|
| Deployment | `CANDIDATE`, `LAB_READY`, `PROMOTION_ELIGIBLE`, `CANARY`, `LAB_STABLE`, `STABLE`, `DRAINING`, `DEPRECATED`, `ARCHIVED` |
|
|
|
|
`LAB_READY`, engineering `PASS`, Advisor `PROMOTION_ELIGIBLE` and an approved request are not
|
|
synonyms for production. Production is an explicit environment on a lifecycle subject and requires
|
|
an evidence-bound approval, immutable plan, rollback snapshot and separate execution.
|
|
|
|
## Transition graph and concurrency
|
|
|
|
The typed graph in `domain/lifecycle_contracts.py` rejects shortcuts. Production follows
|
|
`STABLE → DRAINING → DEPRECATED → ARCHIVED`; restoration from deprecated requires a new explicit
|
|
promotion path, not mutation. LAB supports bounded canary and a separate `LAB_STABLE` state.
|
|
|
|
Every subject has a monotonically increasing `version`. Execution compares the operator's expected
|
|
version before journaling a change. The database also permits only one production/stable deployment
|
|
per capability contract. Conflicts return typed 409 responses; retries use a unique idempotency key.
|
|
|
|
Every transition creates an append-only `LifecycleEvent` containing object, before/after state,
|
|
actor and role, policy revision, evidence IDs, reason, time and change ID. No inference payload or
|
|
secret is stored.
|
|
|
|
M13 adds an independent migration state graph. It does not collapse backfill or external cutover
|
|
truth into deployment lifecycle state; production cutover remains subordinate to a current M12
|
|
approval and matching approved `requires_reindex` promotion plan.
|
|
## M14 operational integration
|
|
|
|
Lifecycle failures and rollback failures feed bounded operational metrics/alerts from the existing
|
|
operation journal. Alert acknowledgement is not lifecycle approval, promotion authority or rollback
|
|
authority. M14 never executes lifecycle remediation; all production changes still require the M12
|
|
evidence-bound policy, immutable plan and explicit actor separation.
|
|
|
|
|
|
## M16 reconciliation under fault
|
|
|
|
An incomplete lifecycle operation is rolled back conservatively from its immutable snapshot on the
|
|
next control-plane start, exactly once. Restart storms do not accumulate: four consecutive restarts
|
|
under load produced no authoritative drift.
|
|
|
|
The `lifecycle_commit_has_evidence` and `no_hidden_auto_promotion` invariants assert that no
|
|
operation reaches `COMMITTED` without its plan, approver and executor, and that no production
|
|
deployment exists without a recorded production approval.
|