ModelForge/docs/product/MODEL_LIFECYCLE.md

Model Lifecycle

Discovery and artifact lifecycle

DISCOVERED
  → CANDIDATE
  → DOWNLOADING
  → QUARANTINED
  → VERIFIED
  → TESTING
  → APPROVED
  → STANDBY / ACTIVE
  → DEPRECATED
  → ARCHIVED

Terminal/side states:

• REJECTED
• INCOMPATIBLE
• SECURITY_BLOCKED
• LICENSE_BLOCKED

Deployment channels

• stable — production-approved project bindings
• candidate — validated candidate awaiting comparison/promotion
• experimental — lab-only use
• archive — retained for evidence or rollback, not routable by normal project traffic

Promotion rules

A model/revision becoming downloadable is not a promotion. Promotion changes deployment/channel state and requires evidence.

M4 adds a non-production evidence chain: verified ArtifactSet → static compatibility → exact-set LAB execution approval → successful RuntimeProbe → LAB_READY DeploymentCandidate. This does not move the Model lifecycle to approved/active, create a stable channel or satisfy benchmark/project gates.

Minimum promotion package:

• immutable model revision;
• approved artifact security status;
• approved license status;
• reproducible runtime profile;
• compatibility probe;
• local benchmark evidence;
• project-specific evidence for affected stable bindings;
• migration plan for non-transparent changes;
• explicit operator approval;
• rollback target.

Upgrade classification

transparent

Wire-compatible and expected not to change persisted derived data. Still requires smoke/performance validation.

behavioral

Same interface but output quality/behavior may change. Requires task/project benchmarks.

requires_reindex

Persistent vectors/features are incompatible across deployment versions. Requires shadow/backfill/cutover workflow.

schema_breaking

Output contract changes. Requires capability contract versioning and project migration.

M5 continues without collapsing identities: LAB_READY candidate → exact supply-chain-backed production approval → stable CapabilityDeployment → cold/warm residency. Promotion does not mutate the ModelRevision, ArtifactSet, RuntimeProfile or candidate. Drain and deprecation remove routing; they do not delete provenance. An embedding deployment also creates an immutable EmbeddingSpace, and any changed identity is requires_reindex.

M12 evidence-bound release lifecycle

M12 makes approval, plan and execution distinct records. Independent integrity, security, runtime, evaluation, project-fit and deployment dimensions are documented in LIFECYCLE_STATE_MODEL.md. Production needs an exact current ApprovalRequest, an immutable PromotionPlan, a rollback snapshot and explicit execution. Canary success stops for review. Deprecation and archive never imply physical deletion; cleanup is a dependency-rechecked operator action. Advisor eligibility remains evidence, not permission.