Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/architecture/adr/0051-manual-canary-observations-are-rehearsal-only.md

@@ -0,0 +1,30 @@
+# ADR-0051: Manual canary observations are rehearsal-only
+
+Status: accepted for P00 containment, 2026-09-08.
+
+The operational Console previously offered fixed successful and failed canary observations.
+The lifecycle service accepted those counters and health fields as canary results. Reaching the
+target count could satisfy the canary review gate without a measured request. Other promotion
+and approval checks remained; this finding does not imply unrestricted production promotion.
+
+Remove both synthetic controls from the Console. Keep manual observation compatibility only for
+an explicitly persisted LAB rehearsal: a LAB_REHEARSAL subject in LAB, a consistent LAB approval
+with LAB_PROMOTION policy, and a plan targeting LAB_STABLE. Client labels and observation fields
+cannot grant that scope. Refuse other manual observations before changing counters, status or
+audit state. Attribute accepted manual observations to the authenticated operator and request
+correlation, and label their result as manual rehearsal evidence.
+
+Also refuse non-rehearsal canary commits, including existing READY records with no authoritative
+evidence. Do not invent a trusted source flag that a client can submit to bypass the restriction.
+This deliberately leaves real canary qualification unavailable until P05 adds an authoritative
+evidence ingestion contract. Existing non-canary transitions retain their independent checks.
+
+P05 must consume deduplicated real gateway requests for the exact candidate/deployment and time
+window, combine observed runtime/scheduler health without converting unknown to healthy, and use
+transactional concurrency control. Production qualification requires that follow-on implementation
+and isolated real-workload evidence. Manual LAB rehearsal proves only the lifecycle mechanics.
+
+No schema change is needed for containment; existing result metadata can label the evidence.
+Rollback to the old implementation would restore the unverified-observation path and is not a
+safe remedy for blocked production canaries. Existing explicit abort/rollback operations remain
+available for reconciliation.