Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/architecture/adr/0055-selected-model-update-inbox.md

@@ -0,0 +1,42 @@
+# ADR 0055: Selected-model update inbox
+
+Status: accepted for selected-model tracking; replacement execution remains separate.
+
+The isolated integration introduces schema `20260909_0029` directly after `20260908_0028`.
+Watch and notice history are authoritative recovery state. An older backup may gain these tables
+only in their exact empty initial state; a current backup must retain their complete semantic
+fingerprints. Temporary check tokens and deadlines are excluded and cleared during restore,
+with an independent readiness check refusing remaining restored claims.
+
+ModelForge is a central hub for selected models and project capabilities. Upstream monitoring
+is opt-in, bounded to 100 explicit model/ref watches. A watch records an existing exact revision
+as its comparison baseline. It does not imply that this revision is deployed or that
+a subsequently observed commit is newer or better. Alternative repositories require their own
+explicit selection; this is not a global model-ranking system.
+
+Manual checks reuse the authenticated Hugging Face metadata and immutable revision boundary.
+They create no download plan, worker execution, approval or deployment. Changed commits produce
+one durable notice per watch/commit. Dismissal preserves history and repeated checks do not revive
+dismissed notices. Lists are bounded and paginated. Provider failure records an error while
+preserving the baseline and existing notices.
+
+An atomic database claim bounds concurrent checks. A five-minute lease allows restart recovery;
+token fencing prevents expired requests from overwriting a successor's state. The audit chain
+serializes creation admission so the 100-watch bound also applies to concurrent creators.
+Reads require viewer and mutations require operator. Nested provider audit events use the same
+authenticated actor and correlation as the watch operation.
+
+Production processes check enabled watches daily by default, at most one due watch per minute
+per API process. Atomic due checks avoid a duplicate scheduled call after another process finishes
+the same watch. This is a per-process throughput limit, not a global cross-process scheduler.
+Development/test lifespans do not start this monitor. Errors are recorded or logged without
+credential content; a monitor configuration flag is not proof of a successful provider check.
+
+Tracking changes use an explicit audited compare-and-swap on the observed version and baseline.
+Baseline changes validate the same model and refuse an active check. Pausing fences in-flight
+check publication; already-started metadata retrieval may finish, but cannot produce a notice
+or overwrite successor state. Historical notice provenance is unchanged. Changing tracking never
+changes a deployment. Broad model search, automatic tests, automatic replacement and model-quality
+claims are not introduced. Project-bound comparison and evidence-backed replacement
+continue through existing capability, evaluation and lifecycle boundaries, including embedding
+migration and rollback. This tranche does not complete that replacement workflow.