Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/architecture/adr/0048-transactional-serving-configuration.md

@@ -0,0 +1,32 @@
+# ADR-0048: Transactional serving configuration
+
+Status: accepted for RC-01, 2026-09-07.
+
+The operator override registry lives in PostgreSQL, alongside its revision history and audit.
+Only explicitly enumerated, non-secret numeric settings consumed by `ServingService` may be
+overridden. A serving request resolves one immutable snapshot on its first policy access, after
+authentication. In-flight requests retain their snapshot. API middleware, process startup, agents and
+workers are not hot-reloaded by this contract; their settings remain deployment-managed.
+
+Precedence is product defaults, Pydantic deployment sources, then operator overrides. The catalog
+does not guess provenance that Pydantic discarded. Preview binds the complete override set,
+effective numeric baseline and active revision to a SHA-256 digest. Apply repeats validation,
+requires that exact preview, and advances the singleton using compare-and-swap. Revision, pointer
+and attributable audit commit together. Audit failure rolls everything back. Concurrent or stale
+previews fail with conflict. Rollback is a new previewed revision, never deletion of history.
+
+Acknowledgement means the control-plane serving settings consumer accepted the typed snapshot for
+new requests. It does not mean an existing request or private worker restarted. Export contains
+portable safe overrides, compatibility metadata and names of secret slots, never credentials or
+credential-bearing connection strings. Import follows the same preview/apply path. Bootstrap
+secrets and deployment settings cannot enter override persistence through import or ordinary edits.
+
+Configuration state and history are authoritative recovery state. A new migration is required;
+qualification must exercise PostgreSQL migration round-trips and concurrent writes. The remaining
+write-only secret lifecycle and interactive identity work are separate RC-01 acceptance criteria.
+
+Implementation note (2026-09-24): the fixed Hugging Face control-plane secret slot was delivered
+under PR #32 and passed exact-source managed full/security run 9327. Together with the safe
+configuration transfer and browser evidence above, this closes RC-CFG-03's functional contract.
+The implementation and its limits are documented in [P01 secret-slot evidence](../../quality/RC_P01_SECRET_SLOTS.md).
+Interactive identity and isolated-RC live provider/root-key qualification remain separate gates.