65 lines
3.6 KiB
Markdown
65 lines
3.6 KiB
Markdown
# ADR 0057: Preserve the deployed migration lineage when integrating the model hub
|
||
|
||
Status: accepted for implementation; deployment qualification pending.
|
||
|
||
## Context
|
||
|
||
The canonical hub and a separately deployed creative branch diverged after schema
|
||
`20260908_0028`. Read-only inspection on 2026-09-09 found image
|
||
`modelforge-api:dfec816` and production schema `20260909_0032`. In that deployed
|
||
lineage, 0029 creates creative allocations, 0030 creates model watches, 0031 adds
|
||
creative governance, and 0032 widens audio workload names. Canonical hub 0029 and
|
||
0030 instead represented newer watches and selected comparisons. The shared
|
||
revision strings do not establish compatible database state.
|
||
|
||
## Decision
|
||
|
||
Preserve the deployed 0029–0032 migration artifacts byte-for-byte. Add 0033 after
|
||
0032 to introduce watch `enabled=true` and `version=1`, runtime history protections,
|
||
and selected-comparison storage. Do not stamp, rename applied migrations, or
|
||
downgrade populated production data to resolve the conflict. New installations
|
||
and upgrades from the common 0028-or-earlier lineage follow this same linear graph.
|
||
|
||
The earlier canonical comparison schema was development qualification, not an
|
||
alternative supported production upgrade source. An isolated database built with
|
||
that conflicting graph must retain its original migration bundle; it cannot be
|
||
upgraded using a revision number alone. Convergence does not authorize discarding
|
||
its data. Any required migration of that separate lineage needs its own explicit,
|
||
verified transfer procedure.
|
||
|
||
Retain canonical project-first navigation, model-watch pause/CAS and bounded
|
||
comparison execution alongside deployed creative history. ModelForge remains the
|
||
central capability hub. This integration adds no model tournament or external
|
||
creative tool execution.
|
||
|
||
Native inference and external grants share accelerator admission locks and account
|
||
for all granted or uncertain reservations. Capacity reads inside admission do not
|
||
commit the owning transaction. Unattributed GPU telemetry is not proof that a
|
||
particular external grant materialized; retain its full reservation until explicit
|
||
release. Queued work must revalidate current client, project, priority and approved
|
||
resource before receiving a grant. Expiry cannot be reversed by a heartbeat.
|
||
|
||
The governance tables belong to the typed persistence model, retaining the exact
|
||
deployed constraints. Downgrading 0033 refuses populated hub or creative history,
|
||
preventing traversal into older destructive downgrade paths.
|
||
|
||
## Recovery and acceptance
|
||
|
||
Recovery preserves creative provenance and explicitly marks restored queued/granted
|
||
allocations uncertain. That state does not claim an external process stopped.
|
||
Selected comparisons remain interrupted with their claims cleared. Deterministic
|
||
projections computed from the source rows must prove these exact changes; missing,
|
||
changed or unclassified history blocks readiness.
|
||
|
||
A deployed watch schema without the new control columns requires a fresh source
|
||
fingerprint with the explicit default-column projection. An old opaque fingerprint
|
||
cannot be rewritten to remove execution-claim fields or invent the new controls.
|
||
Unprojectable archived history remains a recovery blocker requiring its original
|
||
qualified artifact; no hash exception is introduced.
|
||
|
||
Qualify populated 0032→0033 upgrade and actual dump/restore, audit integrity,
|
||
runtime privileges, competing admission transactions, revoked queued authority,
|
||
expiry and UI stale-response handling. All four immutable images, the actual
|
||
deployment upgrade/rollback plan and the release soak remain separate gates.
|
||
Merging this source does not deploy it or establish RC readiness.
|