2.4 KiB
ADR-0048: Transactional serving configuration
Status: accepted for RC-01, 2026-09-07.
The operator override registry lives in PostgreSQL, alongside its revision history and audit.
Only explicitly enumerated, non-secret numeric settings consumed by ServingService may be
overridden. A serving request resolves one immutable snapshot on its first policy access, after
authentication. In-flight requests retain their snapshot. API middleware, process startup, agents and
workers are not hot-reloaded by this contract; their settings remain deployment-managed.
Precedence is product defaults, Pydantic deployment sources, then operator overrides. The catalog does not guess provenance that Pydantic discarded. Preview binds the complete override set, effective numeric baseline and active revision to a SHA-256 digest. Apply repeats validation, requires that exact preview, and advances the singleton using compare-and-swap. Revision, pointer and attributable audit commit together. Audit failure rolls everything back. Concurrent or stale previews fail with conflict. Rollback is a new previewed revision, never deletion of history.
Acknowledgement means the control-plane serving settings consumer accepted the typed snapshot for new requests. It does not mean an existing request or private worker restarted. Export contains portable safe overrides, compatibility metadata and names of secret slots, never credentials or credential-bearing connection strings. Import follows the same preview/apply path. Bootstrap secrets and deployment settings cannot enter override persistence through import or ordinary edits.
Configuration state and history are authoritative recovery state. A new migration is required; qualification must exercise PostgreSQL migration round-trips and concurrent writes. The remaining write-only secret lifecycle and interactive identity work are separate RC-01 acceptance criteria.
Implementation note (2026-09-24): the fixed Hugging Face control-plane secret slot was delivered under PR #32 and passed exact-source managed full/security run 9327. Together with the safe configuration transfer and browser evidence above, this closes RC-CFG-03's functional contract. The implementation and its limits are documented in P01 secret-slot evidence. Interactive identity and isolated-RC live provider/root-key qualification remain separate gates.