ModelForge/docs/operations/RC_ACCEPTANCE.md

Isolated public-candidate acceptance

The Gitea workflow .gitea/workflows/public-candidate-acceptance.yml moves the expensive release proof off a developer workstation and onto a Docker-capable server runner. It is manual-only and accepts an exact canonical commit SHA. It does not invoke unraid-deploy.yml, the deploy controller or the production Compose project.

The job creates a curated public export, validates its content manifest, scans it with Gitleaks, then creates a temporary parentless Git commit so release provenance describes the exact exported tree. From that tree it:

1. builds API, Console, Node Agent and Runtime Worker images with OCI identity;
2. produces the release manifest, checksums, CycloneDX inventory and image provenance;
3. scans every exact image ID with checksum-pinned Trivy and rejects ambiguous reports or any HIGH/CRITICAL finding;
4. starts API, Console, PostgreSQL and Redis with the production overlay under a unique modelforge-rc-* Compose project;
5. uses newly generated secrets, loopback-only ephemeral host ports and project-scoped volumes;
6. proves liveness, readiness, version identity, Console serving and both sides of the operator authentication boundary; and
7. always removes the temporary containers, networks, volumes and four candidate image tags. An independent if: always() workflow cleanup repeats the exact project-label cleanup after a failure, cancellation or timeout; it never runs a host-wide Docker prune.

No Node Agent or Runtime Worker is started by this clean-install gate. Consequently it creates no compute identity and cannot interact with the production GPU node. A later GPU qualification must enrol a disposable rc-canary identity with production_eligible=false and retain that separate evidence.

After the workflow exists on the default branch, dispatch it directly and enter the exact pushed commit. Before merge, dispatch the existing Managed validation workflow on the candidate branch with profile build; that profile calls the same acceptance workflow with gitea.sha. Use the actual intended Console API origin for a publishable artifact; the managed-branch route uses https://modelforge.example.test and therefore produces non-publishable infrastructure rehearsal artifacts. Evidence is retained for 90 days. A failed scan or install is evidence of a blocker, not permission to bypass the gate.