33 lines
2.4 KiB
Markdown
33 lines
2.4 KiB
Markdown
# ADR-0048: Transactional serving configuration
|
|
|
|
Status: accepted for RC-01, 2026-09-07.
|
|
|
|
The operator override registry lives in PostgreSQL, alongside its revision history and audit.
|
|
Only explicitly enumerated, non-secret numeric settings consumed by `ServingService` may be
|
|
overridden. A serving request resolves one immutable snapshot on its first policy access, after
|
|
authentication. In-flight requests retain their snapshot. API middleware, process startup, agents and
|
|
workers are not hot-reloaded by this contract; their settings remain deployment-managed.
|
|
|
|
Precedence is product defaults, Pydantic deployment sources, then operator overrides. The catalog
|
|
does not guess provenance that Pydantic discarded. Preview binds the complete override set,
|
|
effective numeric baseline and active revision to a SHA-256 digest. Apply repeats validation,
|
|
requires that exact preview, and advances the singleton using compare-and-swap. Revision, pointer
|
|
and attributable audit commit together. Audit failure rolls everything back. Concurrent or stale
|
|
previews fail with conflict. Rollback is a new previewed revision, never deletion of history.
|
|
|
|
Acknowledgement means the control-plane serving settings consumer accepted the typed snapshot for
|
|
new requests. It does not mean an existing request or private worker restarted. Export contains
|
|
portable safe overrides, compatibility metadata and names of secret slots, never credentials or
|
|
credential-bearing connection strings. Import follows the same preview/apply path. Bootstrap
|
|
secrets and deployment settings cannot enter override persistence through import or ordinary edits.
|
|
|
|
Configuration state and history are authoritative recovery state. A new migration is required;
|
|
qualification must exercise PostgreSQL migration round-trips and concurrent writes. The remaining
|
|
write-only secret lifecycle and interactive identity work are separate RC-01 acceptance criteria.
|
|
|
|
Implementation note (2026-09-24): the fixed Hugging Face control-plane secret slot was delivered
|
|
under PR #32 and passed exact-source managed full/security run 9327. Together with the safe
|
|
configuration transfer and browser evidence above, this closes RC-CFG-03's functional contract.
|
|
The implementation and its limits are documented in [P01 secret-slot evidence](../../quality/RC_P01_SECRET_SLOTS.md).
|
|
Interactive identity and isolated-RC live provider/root-key qualification remain separate gates.
|