43 lines
3.0 KiB
Markdown
43 lines
3.0 KiB
Markdown
# ADR 0055: Selected-model update inbox
|
|
|
|
Status: accepted for selected-model tracking; replacement execution remains separate.
|
|
|
|
The isolated integration introduces schema `20260909_0029` directly after `20260908_0028`.
|
|
Watch and notice history are authoritative recovery state. An older backup may gain these tables
|
|
only in their exact empty initial state; a current backup must retain their complete semantic
|
|
fingerprints. Temporary check tokens and deadlines are excluded and cleared during restore,
|
|
with an independent readiness check refusing remaining restored claims.
|
|
|
|
ModelForge is a central hub for selected models and project capabilities. Upstream monitoring
|
|
is opt-in, bounded to 100 explicit model/ref watches. A watch records an existing exact revision
|
|
as its comparison baseline. It does not imply that this revision is deployed or that
|
|
a subsequently observed commit is newer or better. Alternative repositories require their own
|
|
explicit selection; this is not a global model-ranking system.
|
|
|
|
Manual checks reuse the authenticated Hugging Face metadata and immutable revision boundary.
|
|
They create no download plan, worker execution, approval or deployment. Changed commits produce
|
|
one durable notice per watch/commit. Dismissal preserves history and repeated checks do not revive
|
|
dismissed notices. Lists are bounded and paginated. Provider failure records an error while
|
|
preserving the baseline and existing notices.
|
|
|
|
An atomic database claim bounds concurrent checks. A five-minute lease allows restart recovery;
|
|
token fencing prevents expired requests from overwriting a successor's state. The audit chain
|
|
serializes creation admission so the 100-watch bound also applies to concurrent creators.
|
|
Reads require viewer and mutations require operator. Nested provider audit events use the same
|
|
authenticated actor and correlation as the watch operation.
|
|
|
|
Production processes check enabled watches daily by default, at most one due watch per minute
|
|
per API process. Atomic due checks avoid a duplicate scheduled call after another process finishes
|
|
the same watch. This is a per-process throughput limit, not a global cross-process scheduler.
|
|
Development/test lifespans do not start this monitor. Errors are recorded or logged without
|
|
credential content; a monitor configuration flag is not proof of a successful provider check.
|
|
|
|
Tracking changes use an explicit audited compare-and-swap on the observed version and baseline.
|
|
Baseline changes validate the same model and refuse an active check. Pausing fences in-flight
|
|
check publication; already-started metadata retrieval may finish, but cannot produce a notice
|
|
or overwrite successor state. Historical notice provenance is unchanged. Changing tracking never
|
|
changes a deployment. Broad model search, automatic tests, automatic replacement and model-quality
|
|
claims are not introduced. Project-bound comparison and evidence-backed replacement
|
|
continue through existing capability, evaluation and lifecycle boundaries, including embedding
|
|
migration and rollback. This tranche does not complete that replacement workflow.
|