Governance and Approval Workflow

Granting a model authority over a machine requires a recorded, multi-party approval quorum — never a single click — with distinct sign-offs for the breeder and burner.

Authority is granted, not defaulted

No model reaches CANARY or PROD by automation. Every promotion that grants or widens authority over the breeder or burner requires an explicit approval quorum: multiple qualified reviewers sign off against the model's validation report, card, and monitoring plan. The approval is recorded, attributable, and append-only, so the question who authorized this model to act is always answerable.

The quorum composition depends on risk. A low-authority canary on a slow breeder shape correction may need fewer sign-offs than granting a burner model authority near the plug systems. Higher-risk promotions require reactor-physics review in addition to controls and safety review. A single reviewer can never self-approve their own model.

What reviewers check

• All validation gates passed with evidence
• Shadow and champion-challenger record supports promotion
• Model card is complete and honest, including limits and gates
• Rollback path is armed and tested
• Monitoring plan defines breach thresholds and responses

def promote(model, to, approvals):
    req = QUORUM[model.machine][to]     # role -> count
    assert satisfies(approvals, req)
    assert no_self_approval(model.author, approvals)
    assert gates_passed(model) and rollback_armed(model)
    registry.log_approval(model, to, approvals)  # append-only
    registry.transition(model, to)

For the burner, governance explicitly requires that no promotion imply a capability past the honest gates — a reviewer cannot approve a model whose card or behavior suggests operating the plug regime as feasible when it is 166 to 830x beyond any device. Governance ties the registry transitions to human accountability and is the backbone of the audit trail across the whole fleet.