Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/operations/RC_ACCEPTANCE.md

@@ -14,7 +14,7 @@ tree. From that tree it:
 3. scans every exact image ID with checksum-pinned Trivy and rejects ambiguous reports or any
    HIGH/CRITICAL finding;
 4. starts API, Console, PostgreSQL and Redis with the production overlay under a unique
-   `modelforge-rc-*` Compose project;
+   `modelforge-validation-*` Compose project;
 5. uses newly generated secrets, loopback-only ephemeral host ports and project-scoped volumes;
 6. proves liveness, readiness, version identity, Console serving and both sides of the operator
    authentication boundary; and
@@ -24,8 +24,94 @@ tree. From that tree it:
 
 No Node Agent or Runtime Worker is started by this clean-install gate. Consequently it creates no
 compute identity and cannot interact with the production GPU node. A later GPU qualification must
-enrol a disposable `rc-canary` identity with `production_eligible=false` and retain that separate
-evidence.
+enrol a disposable `validation-canary` identity with `production_eligible=false` and retain that
+separate evidence.
+
+## P12 runtime-isolation preflight
+
+Before a P12 Node Agent or Runtime Worker starts, render its exact candidate Compose projection to
+JSON and run `scripts/rc_isolation_preflight.py`. The check requires a bounded
+`modelforge-validation-*` project and refuses external/non-project volumes or networks, host
+networking, global container names, non-loopback or
+protected ports, Docker-socket mounts, writable bind mounts, missing bind sources, source paths
+outside the candidate root, and references to named production resources. A read-only bind targeting
+`/app/config` must contain `models/initial-candidates.yaml` under that exact source path. Run the
+preflight before `docker compose up`. After `up`, run it again with
+`--inspect-docker`; it records only resources carrying the exact Compose project label and rejects
+any name outside that project namespace.
+
+This preflight is an admission control, not P12 qualification evidence. A green result does not
+replace the required fresh secrets, `production_eligible=false` `validation-canary` enrollment, real
+private runtime inference, before/after production readiness, normal lifecycle cleanup, or retained
+runtime evidence.
+
+### Dedicated test ingress for a retained RC stack
+
+The disposable clean-install workflow above removes its stack. For a later retained P12 stack,
+include `docker-compose.rc-ingress.yml` after the base and production files. It places PostgreSQL,
+Redis and the migration job on a project-private `backend` network; Web is only on `ingress`, and
+API joins both. The ingress network is created by the exact `modelforge-validation-*` project, not
+shared with production. Bind all published control-plane ports to `127.0.0.1` and choose unused
+ports; the reverse proxy reaches Web and API over the ingress network, not those host ports.
+
+Port 443 is reserved for the existing production services. Its NPM host is still pending because
+the current production Console embeds an HTTP API origin and CSP; the candidate does not change it.
+The candidate must use a separate
+HTTPS test listener on port 18444 with a certificate valid for `modelforge.example.com`. Its
+canonical browser/API origin is `https://modelforge.example.com:18444`; set both
+`MODELFORGE_CORS_ORIGINS` to that value at runtime and use it for `VITE_API_BASE_URL` when building
+the candidate Console image.
+The test listener routes only to the retained validation project.
+
+Render the complete Compose plan with the exact candidate source, four image identities, freshly
+generated validation secrets and intended public origin. Run `rc_isolation_preflight.py` on that
+JSON before starting any container and again with `--inspect-docker` afterward. Add
+`--public-tls-port 18444` only with `docker-compose.validation-tls.yml`; the preflight admits
+this one port solely for the pinned, confined `tls` service. It must show only project-scoped
+networks and volumes, loopback control-plane ports and the exact source-bound config mount.
+The operator must also verify candidate and production stack health before and after startup.
+
+The isolated `tls` service uses a minimal Caddyfile to route `/api/` and `/v1/` to its API and
+`/` to its Web service on the same private ingress network. It binds only port 18444. NPM remains
+on its own networks and keeps port 443 for production. Stage only a protected copy of the NPM
+certificate/key under the private candidate root, outside the image build context; never mount
+the NPM certificate store into the candidate. Follow
+`docs/operations/VALIDATION_TLS_TEST_PORT.md` for exact staging and HTTPS checks. Validate the
+certificate, Console, API calls and browser CSP without disabling TLS verification.
+
+## Candidate stack retention guard
+
+Use `scripts/rc_stack_retention.py` to review server-side `modelforge-validation-*` Compose
+containers whose temporary source tree may have been removed or reduced after a run. Its default
+mode only inspects containers and prints JSON. It reports the oldest container age (stale after 24 hours by default),
+missing bind sources, and a missing `config/models/initial-candidates.yaml` under any `/app/config`
+bind source. Set `--stale-after-hours` to change the age threshold.
+
+```sh
+python3 scripts/rc_stack_retention.py
+python3 scripts/rc_stack_retention.py --stale-after-hours 48
+```
+
+Stopping is limited to one exact stale or incomplete RC project. Before issuing `docker stop`, the
+operator must provide a nonempty retained evidence record and explicitly attest that no jobs are
+active. A running API, one-off job, migration, agent, runtime worker, or unknown service blocks the
+operation. Only running `postgres`, `redis`, or `web` containers from that inspected project may be
+stopped. The command does not remove containers, volumes, networks, or images; it never targets
+`modelforge` or a project outside the bounded validation namespace.
+
+```sh
+python3 scripts/rc_stack_retention.py \
+  --stop-project modelforge-validation-example \
+  --confirm-stop modelforge-validation-example \
+  --confirm-no-active-jobs \
+  --evidence-record /path/to/retained-rc-evidence.json
+```
+
+The evidence record is a UTF-8 JSON object with exactly these fields:
+`{"schema_version":1,"project":"modelforge-validation-example","retained":true,"evidence_reference":"acceptance-run-id"}`.
+The project must match the selected project, and the evidence reference must identify the retained
+acceptance output or audit evidence. The operator is responsible for confirming that the reference
+points to the expected evidence before the stop command.
 
 After the workflow exists on the default branch, dispatch it directly and enter the exact pushed
 commit. Before merge, dispatch the existing **Managed validation** workflow on the candidate branch